bfe0ebe9b41a67d6780ed4e744354f7df03bedaf39dd9a8c24a6ba8b1106b4ac

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DroidJack/Apktool/signapk.jar
Size

7KB
MD5

aec6985fe2314e4d032ba6d192ac4163
SHA1

b16f006e7bf509add528f4b9a075ca373d531203
SHA256

b17534e89a5b58d5e343ba54a49da579cf9213988f4beeae24fe4582a0c226bb
SHA512

5347fb296f87fb71046e0fd261a495485254ed7bd6d68da3aebb346267e5bc14ad8a89aa5496b31b2bf0da35b8c7c4cbbf71ace977443f09ecdbe50e1288bcea
SSDEEP

192:20AfGZ6TJSM/+Lz2dBM8ZRSvdrGanQRSHFzJ:dj6tof2nMySvldT

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3244	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 3244	3764	java.exe	85
PID 3764 wrote to memory of 3244	3764	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DroidJack\Apktool\signapk.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
0ec11f3711083c6d4e3eb2606ff8dc45

SHA1
782eccfbb4875cbcf880c590f9262067ffd9d0bc

SHA256
868c5b2b3dd8da6caf822a6d1e3a66ee7d881bfb17faa111927c747fae779acc

SHA512
15d1acf376003088819ffd3f4d40dcf11536838280df61eb7cf687eb6184f2ec0c96ef46076717a4a23d249ebb7c5a3b394553a0a4ed5889d1ecf58dd2bec6f2

Download Submit
memory/3764-2-0x0000025023FF0000-0x0000025024260000-memory.dmp

Filesize
2.4MB

Download
memory/3764-13-0x0000025023FF0000-0x0000025024260000-memory.dmp

Filesize
2.4MB

Download
memory/3764-12-0x00000250225D0000-0x00000250225D1000-memory.dmp

Filesize
4KB

Download