9f000e49c75142dd94ed9688dea77505afd31642bc9e953a69a5d2863156b0e0

Analysis

max time kernel
88s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-jsoup-ext.jar
Size

19KB
MD5

d963210c02cd1825e967086827da8294
SHA1

26c4d004b5ffdb8f81de2d6b158a3f34819faf01
SHA256

7908145cf17301bedefd6e3af8c93e0320582c0562919ffb56cc21b7fd532b96
SHA512

756c21dc1a02d579f0e2ed39e5bedca5491087cdc28e3e96c8663a493bcfeeeeea44dc40681ec6341426dfa995883dbce11b76d1f921e043ae220399a9e554fb
SSDEEP

384:LbCDj5HBuJXm9XPDUbrXywgqYw6QENTQxS76lXtz2MQHZg6+Cr:L+D/MXADerZgfwcQi6lXtz2MQHZg6+Cr

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4784	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4784	4964	java.exe	81
PID 4964 wrote to memory of 4784	4964	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-jsoup-ext.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
62e1a80e4e4a2e5265e381e3852af3d9

SHA1
f70b544fea9b107fe76b62d377fc3de023b7c858

SHA256
de05bd53d861939cff2caffd1885ab3678a28266b3ab848eeb392f8363a5a08d

SHA512
fb7c4881989ebf357168ae5e0695f6e55f00a932d7965ddce853e544a952a3a5b02ded62a4b009a943dc089d15cdd27e289759c34ed51d0a75a9effa3a57e160

Download Submit
memory/4964-4-0x00000148E2B60000-0x00000148E3B60000-memory.dmp

Filesize
16.0MB

Download
memory/4964-11-0x00000148E2B40000-0x00000148E2B41000-memory.dmp

Filesize
4KB

Download
memory/4964-13-0x00000148E2B60000-0x00000148E3B60000-memory.dmp

Filesize
16.0MB

Download