9f000e49c75142dd94ed9688dea77505afd31642bc9e953a69a5d2863156b0e0

Analysis

max time kernel
80s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-zend-ext.jar
Size

95KB
MD5

4bc2aea7281e27bc91566377d0ed1897
SHA1

d02d897e8a8aca58e3635c009a16d595a5649d44
SHA256

4aef566bbf3f0b56769a0c45275ebbf7894e9ddb54430c9db2874124b7cea288
SHA512

da35bb2f67bca7527dc94e5a99a162180b2701ddca2c688d9e0be69876aca7c48f192d0f03d431ccd2d8eec55e0e681322b4f15eba4db29ef5557316e8e51e10
SSDEEP

1536:yZwgOueuKZ4THgWvLnhgmmJFgVn+nhEA1ODIrSrUricEDMrV+LAB:yZwgwuKmTDFgmmoVn+mAUhrUicRoAB

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3104	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 3104	3960	java.exe	81
PID 3960 wrote to memory of 3104	3960	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-zend-ext.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
5a783fa2e7822e220257fed67d901f7a

SHA1
50e60ef03353c0c1877c694a26e2dd616f83caad

SHA256
f2764cbe83af9f4014d6e4bad7c6d5dbef64bd28b47fc22736822382818d88da

SHA512
8aba37fe08989286f260cd833711f2c5514f0aebc3a6cb8b83be234ee63fadbf7ee96c93a4d4a4368ff72d870c9ac255fb96ed745db654f697fd9ebbbc6f4259

Download Submit
memory/3960-2-0x00000271E2210000-0x00000271E3210000-memory.dmp

Filesize
16.0MB

Download
memory/3960-12-0x00000271E0920000-0x00000271E0921000-memory.dmp

Filesize
4KB

Download