9f000e49c75142dd94ed9688dea77505afd31642bc9e953a69a5d2863156b0e0

Analysis

max time kernel
139s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-xml-ext.jar
Size

19KB
MD5

0a79304556a1289aa9e6213f574f3b08
SHA1

7ee3bde3b1777bf65d4f62ce33295556223a26cd
SHA256

434e57fffc7df0b725c1d95cabafdcdb83858ccb3e5e728a74d3cf33a0ca9c79
SHA512

1560703d0c162d73c99cef9e8ddc050362e45209cc8dea6a34a49e2b6f99aae462eae27ba026bdb29433952b6696896bb96998a0f6ac0a3c1dbbb2f6ebc26a7e
SSDEEP

384:dti5BMxSo4LgAAsJilYcmwPbEM0Av7wGkJXbhS1OaVKD6U2:DqoCgqyIMZwRJLQO5eU2

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4036	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 4036	1376	java.exe	81
PID 1376 wrote to memory of 4036	1376	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-xml-ext.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c939ea05b78d0fb48e7f98eed9689504

SHA1
e99c7d1b64f8f320cfa33339460d3965a2e51992

SHA256
9b615033fde55f65c295dfa44b3957b04e246a4f0a9a164b541c9391e848905f

SHA512
87cec2b922d9e3d094b717536d0792b4af3702259a944e768e901bd7c6d2ef51cb318d772b9c257e6d2727c9c4bc9402b731c21d899bd0934570330b01b14a1b

Download Submit
memory/1376-4-0x0000015E67D70000-0x0000015E68D70000-memory.dmp

Filesize
16.0MB

Download
memory/1376-11-0x0000015E66510000-0x0000015E66511000-memory.dmp

Filesize
4KB

Download
memory/1376-13-0x0000015E67D70000-0x0000015E68D70000-memory.dmp

Filesize
16.0MB

Download