31ee8b1f5a729087bfcd58265b4558d9c382736e74934a18200756ac672f6005

Analysis

max time kernel
145s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02/05/2024, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-core.jar
Size

464KB
MD5

7e5e3d6d352025bd7f093c2d7f9b21ab
SHA1

ad9bfc2c3d70c574d34a752c5d0ebcc43a046c57
SHA256

5b37e8ff2850a4cbb02f9f02391e9f07285b4e0667f7e4b2d4515b78e699735a
SHA512

c19c29f8ad8b6beb3eed40ab7dc343468a4ca75d49f1d0d4ea0b4a5cee33f745893fba764d35c8bd157f7842268e0716b1eb4b8b26dcf888fb3b3f4314844aad
SSDEEP

12288:pyfuv+DnikW2IfqFXKzNGNyyRmfD4vCgdiRST:pLWDnid2IfZGAyAfczdig

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
408	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 408	2268	java.exe	79
PID 2268 wrote to memory of 408	2268	java.exe	79

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-core.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
88691fe326b1411fbffba7acf6b08b7c

SHA1
8f5bed1aaf746696f9825a89c9170d9bc6ef16c4

SHA256
0adb9b16cfb34917eb413a7a21bfc23957ecad8b57b34be7782583ee50843cb6

SHA512
1e5f1548ffd1352835157417562a370a57570db9ea42ee58ad55bd31fb4b1dbedb7ec5d49646f0c5b89ea1617e6375ffd48ca44c6975a702a6dc843fb0118841

Download Submit
memory/2268-2-0x0000021280000000-0x0000021280270000-memory.dmp

Filesize
2.4MB

Download
memory/2268-12-0x00000212FC8D0000-0x00000212FC8D1000-memory.dmp

Filesize
4KB

Download
memory/2268-13-0x0000021280000000-0x0000021280270000-memory.dmp

Filesize
2.4MB

Download