31ee8b1f5a729087bfcd58265b4558d9c382736e74934a18200756ac672f6005

Analysis

max time kernel
90s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
02-05-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-zend-ext.jar
Size

95KB
MD5

4bc2aea7281e27bc91566377d0ed1897
SHA1

d02d897e8a8aca58e3635c009a16d595a5649d44
SHA256

4aef566bbf3f0b56769a0c45275ebbf7894e9ddb54430c9db2874124b7cea288
SHA512

da35bb2f67bca7527dc94e5a99a162180b2701ddca2c688d9e0be69876aca7c48f192d0f03d431ccd2d8eec55e0e681322b4f15eba4db29ef5557316e8e51e10
SSDEEP

1536:yZwgOueuKZ4THgWvLnhgmmJFgVn+nhEA1ODIrSrUricEDMrV+LAB:yZwgwuKmTDFgmmoVn+mAUhrUicRoAB

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4592	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4592	1988	java.exe	82
PID 1988 wrote to memory of 4592	1988	java.exe	82

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-zend-ext.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
3ab1351533d53be9b4f29d21282773ba

SHA1
3458fb9b9f40f8f861eaa27c8f52f712233dd518

SHA256
8c2b46c6fecb96f85ceabac3b51529fd73e2ca8bcdb052476e851f119b5b54d3

SHA512
4c96729069e6620a53def903c3e978602cce2ca538f19a28d219495704dd08187405a67fe013a51933ed76e38d72cef7605e8ec1da217f4c663e2242cd87e05f

Download Submit
memory/1988-2-0x000001B9235E0000-0x000001B923850000-memory.dmp

Filesize
2.4MB

Download
memory/1988-12-0x000001B921F90000-0x000001B921F91000-memory.dmp

Filesize
4KB

Download
memory/1988-13-0x000001B9235E0000-0x000001B923850000-memory.dmp

Filesize
2.4MB

Download