31ee8b1f5a729087bfcd58265b4558d9c382736e74934a18200756ac672f6005

Analysis

max time kernel
88s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02-05-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/jphp-zip-ext.jar
Size

12KB
MD5

20f6f88989e806d23c29686b090f6190
SHA1

1fdb9a66bb5ca587c05d3159829a8780bb66c87d
SHA256

9d5f06d539b91e98fd277fc01fd2f9af6fea58654e3b91098503b235a83abb16
SHA512

2798bb1dd0aa121cd766bd5b47d256b1a528e9db83ed61311fa685f669b7f60898118ae8c69d2a30d746af362b810b133103cbe426e0293dd2111aca1b41ccea
SSDEEP

192:yXmigootuYzXKKk6BL8UUJY0eP6nHY2AJ4qxivXRp2gFyjSonqKLRM7RbEZ:Km0WzX7k6eJB06HZYwRzFyj0uRM7RbEZ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1664	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1664	3868	java.exe	81
PID 3868 wrote to memory of 1664	3868	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jphp-zip-ext.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
e9b4bb76352a4c35e241d82722f35e57

SHA1
9f95ce7edda4b008e02632f460a9f3241b4e677a

SHA256
b1c60affe7af343f5a0f1f5a12c3795ee228fbdeeb1d698de119166d40a90d45

SHA512
087c609140930a7af57967cbf1a96340226dca06b6736943b550150f11ac22afc381a54f650e8826309f0132b0e5b9695002f9a553a65a95083018e9e4b52696

Download Submit
memory/3868-2-0x0000022341CD0000-0x0000022341F40000-memory.dmp

Filesize
2.4MB

Download
memory/3868-12-0x0000022341CB0000-0x0000022341CB1000-memory.dmp

Filesize
4KB

Download
memory/3868-13-0x0000022341CD0000-0x0000022341F40000-memory.dmp

Filesize
2.4MB

Download