36bc30177e29b9a1a440df85c764d0fa6c9e5c7ff6119ff41a05fadee36f0b82

Analysis

max time kernel
138s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

apktool/apktool.jar
Size

8.9MB
MD5

a15507953bd9b89c2d6570f46fb1f774
SHA1

261a8e68c72b0ebf70894c40b3c35176a66d86fe
SHA256

0e543660bf2d16fe7c543d4034ef505a6ddccb883416c8aa68d1a1d779b057f2
SHA512

eb519a94a4aecc1358f4a1cc84e03c772d8b59edf8b5e37956a756f0cc2673c5d9d976ad6796543db74cf187763077b4bbcd0519e7f7be845c0e9874d4862353
SSDEEP

196608:lIkbXnl3I3rmGQFTbuGzuJVzNfaTWkxQcGhiO:lIw+mGyTNzuJNkTWk0

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1232 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3364 wrote to memory of 1232 3364 java.exe icacls.exe
PID 3364 wrote to memory of 1232 3364 java.exe icacls.exe

pid	process
1232	icacls.exe

description	pid	process	target process
PID 3364 wrote to memory of 1232	3364	java.exe	icacls.exe
PID 3364 wrote to memory of 1232	3364	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\apktool\apktool.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1232

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
fbdf6b5c6037ee274d73365fea3bba8a

SHA1
d1b25f69726170dac8c295326aabfc4a3f118e92

SHA256
c789ae365fcd8cb06a2651798aeac6336aeae69a03b10780448f6c70a39428e4

SHA512
df956fa544ab857e6b9b82f29728edf518dfd5c4c2493265e3f2cee3917d9f786992499f6d6897b3a66bce6cad25d8fcb7d70e422abcd3999f6e66931f895cac

Download Submit
memory/3364-2-0x00000164A37D0000-0x00000164A3A40000-memory.dmp

Filesize
2.4MB

Download
memory/3364-14-0x00000164A2180000-0x00000164A2181000-memory.dmp

Filesize
4KB

Download
memory/3364-15-0x00000164A37D0000-0x00000164A3A40000-memory.dmp

Filesize
2.4MB

Download