8af7426a81b1a20eb080b6a8a734736734f99de90c8b2bbf80e6c909d6278277

Analysis

max time kernel
62s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 02:05

Target

Setup_2406.exe
Size

32KB
MD5

ec92a0e22e4e84d70fa341012d8deacd
SHA1

2d07853d63619dc27a1aa39bd0eb15be1de7fc1c
SHA256

8af7426a81b1a20eb080b6a8a734736734f99de90c8b2bbf80e6c909d6278277
SHA512

fd4aa6b5b108b1c67b426b4104924dbef62a42c8e565a7fa5b10370325c6913ff64cdd9b9459a866c877c6652dcd11a5a28a39608147d7967bcea6f466fd9d8b
SSDEEP

384:4oI1gYZw33FUWUcC6TBhdsDgZH4o5NEvdlcn0ScPmPn0Avsl9EPg/s4Xsn+KvHKj:a7Zw33FNUf6Nhd/fQ1l+0vM0iT9

Score

7^/10

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1756 icacls.exe

pid	process
1756	icacls.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Setup_2406.exejavaw.exe

description	pid	process	target process
PID 2520 wrote to memory of 1488	2520	Setup_2406.exe	javaw.exe
PID 2520 wrote to memory of 1488	2520	Setup_2406.exe	javaw.exe
PID 1488 wrote to memory of 1756	1488	javaw.exe	icacls.exe
PID 1488 wrote to memory of 1756	1488	javaw.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\Setup_2406.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_2406.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher
2⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
3⤵
- Modifies file permissions
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2668,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
1⤵
PID:5060

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
e68e58cc7b313c5da4467038f66d42a9

SHA1
013d87ae8e1a2d7089ebd0e2416061349a3232a2

SHA256
6ddac95b3a96bf0954b9cfc32d58979168bd26c171f6670adc1007f5c6b0f2a4

SHA512
a0bc6c4dbf490c6addf7b3da18561063d7354a79772f2becf3e15da2d26af451176bdcfc8d2396c1f69973e472322afff8683db46afe08ddeb2cda5214ea1dec

Download Submit
memory/1488-3-0x0000014200000000-0x0000014200270000-memory.dmp

Filesize
2.4MB

Download
memory/1488-14-0x000001427DD10000-0x000001427DD11000-memory.dmp

Filesize
4KB

Download
memory/1488-15-0x0000014200000000-0x0000014200270000-memory.dmp

Filesize
2.4MB

Download
memory/2520-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download