a51dd83fb2f8ab618515855475f83188b18872db105b624ec4f40a444e09e818

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-uk
resource tags

arch:x64arch:x86image:win10v2004-20240412-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
15-04-2024 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

apktool/signapk.jar
Size

7KB
MD5

aec6985fe2314e4d032ba6d192ac4163
SHA1

b16f006e7bf509add528f4b9a075ca373d531203
SHA256

b17534e89a5b58d5e343ba54a49da579cf9213988f4beeae24fe4582a0c226bb
SHA512

5347fb296f87fb71046e0fd261a495485254ed7bd6d68da3aebb346267e5bc14ad8a89aa5496b31b2bf0da35b8c7c4cbbf71ace977443f09ecdbe50e1288bcea
SSDEEP

192:20AfGZ6TJSM/+Lz2dBM8ZRSvdrGanQRSHFzJ:dj6tof2nMySvldT

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4648 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1672 wrote to memory of 4648 1672 java.exe icacls.exe
PID 1672 wrote to memory of 4648 1672 java.exe icacls.exe

pid	process
4648	icacls.exe

description	pid	process	target process
PID 1672 wrote to memory of 4648	1672	java.exe	icacls.exe
PID 1672 wrote to memory of 4648	1672	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\apktool\signapk.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1d9d6602eadef8fb54ea28720f995abc

SHA1
84627ec17cec8b2d1ce933e405ed528e87668d1d

SHA256
fdc13bdfe0582a27bdd1a1f8fc988513b58739a2bd2f5ef3dbd4c2f6eb66d896

SHA512
ef9af5e3d09cdfc877ebec363bbd8645fed24e7ed5a739c81106d3c7eac41fa391fa2a57cf9b27563233146934deea5c8d086ed18d6c3e1bbc9ca80b22bdf5a2

Download Submit
memory/1672-4-0x00000160AD400000-0x00000160AE400000-memory.dmp

Filesize
16.0MB

Download
memory/1672-11-0x00000160ABC10000-0x00000160ABC11000-memory.dmp

Filesize
4KB

Download