6d214bfa186bbb39302b1d8ec3ddd57c161064f55d579983d391edea9e6036a9

Analysis

max time kernel
86s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
15/04/2024, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
platformBinary32/bin/apktool.jar
Size 10.5MB
Sample240415-lsdk7sbd88
SHA256 758b1bd58f9c9dd5ca85258d31c75f32e5878a502e3d75c66f3bfacf74b9dc1d
MD5 ea45fba42cc01f82b7b805a1823af211
SHA1 0c9751a0c03965cf71d26c4d2d9071e85934465b
SHA512 6503fe3e80f83b09e07e97d7888a7fa686e46b0e7a8501de13e134047cd0533bb3ce80f776e63ee4056eae77dad991481bc68dd423fae69766bad11157e253f3
SSDEEP 196608:+7ymmCUyiCGyXpyR9f3ID5nBGM3iJnoVnSwS3xAW2LpRXHlUzWmK:+7yOUB+pyvfI1ImiFoswKxAWKdj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5080	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 5080	3904	java.exe	78
PID 3904 wrote to memory of 5080	3904	java.exe	78

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\apktool.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 c7d8cb607f9cad21f65a7e8bb04e035e9873ba9aa99e728d843731fbafa63cc2
MD5 8309f5c38e91807e34501a11a62e54c1
SHA1 7aed8a1b793725ef8935d8a1a705f3aead590e7c
SHA512 e0a3b8331b8a011e803d41cb4b822bb72988ab8184280d4125d820d3c1d22c310dde9752d647f4b9926c9c08c09a20bd3bf1de61621210179e4bf362e4dc18c1
MD5 SHA1 SHA512

Submit Download

memory/3904-4-0x000001C366700000-0x000001C367700000-memory.dmp

Download

memory/3904-12-0x000001C364EB0000-0x000001C364EB1000-memory.dmp

Download

memory/3904-16-0x000001C364EB0000-0x000001C364EB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads