31ee8b1f5a729087bfcd58265b4558d9c382736e74934a18200756ac672f6005

Analysis

max time kernel
88s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02/05/2024, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-jsoup-ext.jar
Size

19KB
MD5

d963210c02cd1825e967086827da8294
SHA1

26c4d004b5ffdb8f81de2d6b158a3f34819faf01
SHA256

7908145cf17301bedefd6e3af8c93e0320582c0562919ffb56cc21b7fd532b96
SHA512

756c21dc1a02d579f0e2ed39e5bedca5491087cdc28e3e96c8663a493bcfeeeeea44dc40681ec6341426dfa995883dbce11b76d1f921e043ae220399a9e554fb
SSDEEP

384:LbCDj5HBuJXm9XPDUbrXywgqYw6QENTQxS76lXtz2MQHZg6+Cr:L+D/MXADerZgfwcQi6lXtz2MQHZg6+Cr

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
532	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 532	3504	java.exe	81
PID 3504 wrote to memory of 532	3504	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-jsoup-ext.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
e1edeac946fa3ee599775b3b3bf51e76

SHA1
4fe26232fceb33c0b6875b959ab7c919592dd729

SHA256
2ff5d4e9d6579cd052477ace6f305446ffd9c753d99c1048c7fbc0b3951b5ae1

SHA512
c0f150a8b67ebe72dad39323871a6413c2809e9effdf246d2fee98d7397ba4ba16c69e2cb698cace6a2107712b3dd2d654a59c8ad074f2c2eb4fff63118dea35

Download Submit
memory/3504-2-0x00000222BEA70000-0x00000222BECE0000-memory.dmp

Filesize
2.4MB

Download
memory/3504-12-0x00000222BD1A0000-0x00000222BD1A1000-memory.dmp

Filesize
4KB

Download
memory/3504-13-0x00000222BEA70000-0x00000222BECE0000-memory.dmp

Filesize
2.4MB

Download