9f000e49c75142dd94ed9688dea77505afd31642bc9e953a69a5d2863156b0e0

Analysis

max time kernel
141s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-zip-ext.jar
Size

12KB
MD5

20f6f88989e806d23c29686b090f6190
SHA1

1fdb9a66bb5ca587c05d3159829a8780bb66c87d
SHA256

9d5f06d539b91e98fd277fc01fd2f9af6fea58654e3b91098503b235a83abb16
SHA512

2798bb1dd0aa121cd766bd5b47d256b1a528e9db83ed61311fa685f669b7f60898118ae8c69d2a30d746af362b810b133103cbe426e0293dd2111aca1b41ccea
SSDEEP

192:yXmigootuYzXKKk6BL8UUJY0eP6nHY2AJ4qxivXRp2gFyjSonqKLRM7RbEZ:Km0WzX7k6eJB06HZYwRzFyj0uRM7RbEZ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
124	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 124	2396	java.exe	81
PID 2396 wrote to memory of 124	2396	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-zip-ext.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
5f1cbe0aeee0e7f4b0fa377374eb2b2f

SHA1
8e3a553f37ad9b194acd18f04b87cdfe2cf11faf

SHA256
1c1781ce615fdc0654040c743a222f68e0e36c9087e3e796d948b1ef036bb69b

SHA512
a95af351fa0190dd17976c23623f965af7e36b7fc6b5a23cf8c2941888d64ce995eb62d7c47f7a18a8f0fd29c7b349a198e9386d203cea794908d16b92bc68a3

Download Submit
memory/2396-6-0x0000026800000000-0x0000026801000000-memory.dmp

Filesize
16.0MB

Download
memory/2396-11-0x00000268762C0000-0x00000268762C1000-memory.dmp

Filesize
4KB

Download
memory/2396-13-0x0000026800000000-0x0000026801000000-memory.dmp

Filesize
16.0MB

Download