9f000e49c75142dd94ed9688dea77505afd31642bc9e953a69a5d2863156b0e0

Analysis

max time kernel
100s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-gui-ext.jar
Size

688KB
MD5

6696368a09c7f8fed4ea92c4e5238cee
SHA1

f89c282e557d1207afd7158b82721c3d425736a7
SHA256

c25d7a7b8f0715729bccb817e345f0fdd668dd4799c8dab1a4db3d6a37e7e3e4
SHA512

0ab24f07f956e3cdcd9d09c3aa4677ff60b70d7a48e7179a02e4ff9c0d2c7a1fc51624c3c8a5d892644e9f36f84f7aaf4aa6d2c9e1c291c88b3cff7568d54f76
SSDEEP

12288:sSn9gd/GXLtKb+Ozu5idmEfcHOPJZ7bw1kXn0yZLJZsDDpJSWB5qSEhQ:sMw/GXUb+euCVIOxRQIZOnuK

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2388	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2388	1348	java.exe	82
PID 1348 wrote to memory of 2388	1348	java.exe	82

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-gui-ext.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
0a60f866ab74062997e8c1290e85dac8

SHA1
dd4e543e2a0b161b02bb49770f5a89b3821d88d0

SHA256
b93500d29406b782444b2589846a29d229483b8572429fde5fed0da36cb44644

SHA512
17bf1f7c7ceb855c3e7d67196dd6c6066b73c939568ec95d2227029e74f493e9086714abc2ee145a3ffc3ed54e713e8ff9efb9158131492a3daa5560149b19c7

Download Submit
memory/1348-4-0x0000025900000000-0x0000025901000000-memory.dmp

Filesize
16.0MB

Download
memory/1348-11-0x000002597CE10000-0x000002597CE11000-memory.dmp

Filesize
4KB

Download
memory/1348-13-0x0000025900000000-0x0000025901000000-memory.dmp

Filesize
16.0MB

Download