a51dd83fb2f8ab618515855475f83188b18872db105b624ec4f40a444e09e818

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240412-uk
resource tags

arch:x64arch:x86image:win10v2004-20240412-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
15-04-2024 14:02

Target

apktool/apktool.bat
Size

135B
MD5

b02966b106045115fa8ef94a4e67537b
SHA1

f901df8bbfe8fe50e560e625a27da1c6c4f0e9b3
SHA256

3d8108beb40535e68e7f6421a4309408ea5efab91707fa25d862154e3cc9b6df
SHA512

6274a4568285c74985b095d1dd5649044b61cb7c372dc4653c62a2b92833df477f5a5453be0e598622918b4e6c27064a57e5fba1a657dd064e6d9598fe2f94cc

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

780 icacls.exe

pid	process
780	icacls.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exejava.exe

description	pid	process	target process
PID 1460 wrote to memory of 4656	1460	cmd.exe	java.exe
PID 1460 wrote to memory of 4656	1460	cmd.exe	java.exe
PID 4656 wrote to memory of 780	4656	java.exe	icacls.exe
PID 4656 wrote to memory of 780	4656	java.exe	icacls.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\apktool\apktool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar -Duser.language=en "C:\Users\Admin\AppData\Local\Temp\apktool\\apktool.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:780

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1de04318ff121d9a56307a9bd961e15e

SHA1
a0939418ff97e73ccd601b1971cde582713ab9bb

SHA256
7ae6d719e44ad026f68c77cff5c0f0acb65dfb03bdc9cbcb19ac992c07a8bc64

SHA512
cf784b7406764fc3456ee50447df36a5ec32308e55a88ba3ec8893bca63cabeddc979231209bfa038e190d3f342dcd3d789ef985ffed235e2072f0cfb7039f81

Download Submit
memory/4656-4-0x000001B8F00F0000-0x000001B8F10F0000-memory.dmp

Filesize
16.0MB

Download
memory/4656-12-0x000001B8EE830000-0x000001B8EE831000-memory.dmp

Filesize
4KB

Download
memory/4656-15-0x000001B8EE830000-0x000001B8EE831000-memory.dmp

Filesize
4KB

Download