36bc30177e29b9a1a440df85c764d0fa6c9e5c7ff6119ff41a05fadee36f0b82

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 13:08

Target

apktool/apktool.bat
Size

135B
MD5

b02966b106045115fa8ef94a4e67537b
SHA1

f901df8bbfe8fe50e560e625a27da1c6c4f0e9b3
SHA256

3d8108beb40535e68e7f6421a4309408ea5efab91707fa25d862154e3cc9b6df
SHA512

6274a4568285c74985b095d1dd5649044b61cb7c372dc4653c62a2b92833df477f5a5453be0e598622918b4e6c27064a57e5fba1a657dd064e6d9598fe2f94cc

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4052 icacls.exe

pid	process
4052	icacls.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exejava.exe

description	pid	process	target process
PID 868 wrote to memory of 4388	868	cmd.exe	java.exe
PID 868 wrote to memory of 4388	868	cmd.exe	java.exe
PID 4388 wrote to memory of 4052	4388	java.exe	icacls.exe
PID 4388 wrote to memory of 4052	4388	java.exe	icacls.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\apktool\apktool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar -Duser.language=en "C:\Users\Admin\AppData\Local\Temp\apktool\\apktool.jar"
2⤵
- Suspicious use of WriteProcessMemory
PID:4388

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
3⤵
- Modifies file permissions
PID:4052

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
f4f759ce63f40795c1552e33d91461c9

SHA1
d8cefc1a3a912d5db9db052d2ce2c98ed674b06b

SHA256
cc1da29af9b714a1ca3e38a00027462246dec6e0c9c093f4c5c50fd16d6675df

SHA512
2b803f30c2a115d675c0eec383825fb00b7a2489b579eab6861c915249317556a623dcb2de70f05922e7dc0ff0119648d143dc1c18e174faa68df6c48756308d

Download Submit
memory/4388-2-0x0000020FAC7A0000-0x0000020FACA10000-memory.dmp

Filesize
2.4MB

Download
memory/4388-12-0x0000020FAAEE0000-0x0000020FAAEE1000-memory.dmp

Filesize
4KB

Download
memory/4388-15-0x0000020FAAEE0000-0x0000020FAAEE1000-memory.dmp

Filesize
4KB

Download
memory/4388-16-0x0000020FAC7A0000-0x0000020FACA10000-memory.dmp

Filesize
2.4MB

Download