9f000e49c75142dd94ed9688dea77505afd31642bc9e953a69a5d2863156b0e0

Analysis

max time kernel
137s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09-03-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-runtime.jar
Size

1.1MB
MD5

d5ef47c915bef65a63d364f5cf7cd467
SHA1

f711f3846e144dddbfb31597c0c165ba8adf8d6b
SHA256

9c287472408857301594f8f7bda108457f6fdae6e25c87ec88dbf3012e5a98b6
SHA512

04aeb956bfcd3bd23b540f9ad2d4110bb2ffd25fe899152c4b2e782daa23a676df9507078ecf1bfc409ddfbe2858ab4c4c324f431e45d8234e13905eb192bae8
SSDEEP

24576:cP4MBZrpGi4exQ9qdXVd/F/3yy7mgviLzIM:czHMi4eKCd/BzaLcM

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3508	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3508	760	java.exe	81
PID 760 wrote to memory of 3508	760	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-runtime.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
73f646205677cda9ff534a14c751e723

SHA1
ab592571dd60faca83d0f2be67bd3a80452c45ed

SHA256
f8c1d1e74c4a14ff215c2ff2f29636d405840eb6d015b8ec58feb43bb80cd9ac

SHA512
b8de0b4eaaebd2237ce354a48caa6933e0fb679dd48bd36f6ba006c5f75fa5356ce7e6f797a990da87eb4a10cb74e5c83994d58a7bc27788609cffd8da64630f

Download Submit
memory/760-4-0x0000022E359B0000-0x0000022E369B0000-memory.dmp

Filesize
16.0MB

Download
memory/760-12-0x0000022E340F0000-0x0000022E340F1000-memory.dmp

Filesize
4KB

Download