6f48584e66b9dae4b0a1e4b449a3f3b5a05d7bcee807e802b157bc36fb293be1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

META-INF/ANE/Android-ARM/EasyPushAPI.jar
Size

226KB
MD5

d4c076bb399e9524c1456465a4068670
SHA1

6d9925fc17f54633407404711a56b1898623f54a
SHA256

ccbb4c8c4904bf9ac772c622c3cef3b020ad5a66b2caf17c76211e4abd52ae55
SHA512

339a55006843f6a79948e2a5261831562f6c72e099920f2155321e8e7745a2ff04773dab2a201b699f6da394740ac18011cef79009c6eb990ea2996ccf444cee
SSDEEP

6144:bv3WMGXtPPFyocpfXJhVDEP8mtsaauBwub:bv3AN9yocDToP8mHa+H

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2116	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2116	1864	java.exe	86
PID 1864 wrote to memory of 2116	1864	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\META-INF\ANE\Android-ARM\EasyPushAPI.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f8f5716a8ee62c35bc0d5bfd3317ca9b

SHA1
3697eb13566e099a3dda4d58c4e9994324871278

SHA256
14d51f5a4aff935634eed33ca5c2b1b8053a34c386d5dc9343aa45703dae7449

SHA512
ac304a6c023767e7f8fc9479d5abeb5972236cfe8aaab1f857891acc173f5a1b4ae7f7f5be7ecaf3f471b169eac7df5752f86590d46df5f0ec51ae25f34f2e1a

Download Submit
memory/1864-10-0x00000130427D0000-0x00000130437D0000-memory.dmp

Filesize
16.0MB

Download
memory/1864-11-0x00000130427B0000-0x00000130427B1000-memory.dmp

Filesize
4KB

Download
memory/1864-13-0x00000130427D0000-0x00000130437D0000-memory.dmp

Filesize
16.0MB

Download