bfe0ebe9b41a67d6780ed4e744354f7df03bedaf39dd9a8c24a6ba8b1106b4ac

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DroidJack/DroidJack_lib/commons-codec-1.6.jar
Size

227KB
MD5

5970f54883b4831b24b97f1125ba27e6
SHA1

b7f0fc8f61ecadeb3695f0b9464755eee44374d4
SHA256

54b34e941b8e1414bd3e40d736efd3481772dc26db3296f6aa45cec9f6203d86
SHA512

752fca09371e0e228432155533a9b84f0442cafd7f25ebf0c6c2024d541fbba80882e71aee047ec94cd22c0d8114942e967652913412f5cbcf9b816c0e1fc1ad
SSDEEP

6144:PDTWpPoPf1mNIr6ZuH9FYaGC5Y79N22RKzvqDNuwv3:P2FoPf1mNSR2vvpN8ziD8Q

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4604	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 4604	1356	java.exe	86
PID 1356 wrote to memory of 4604	1356	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DroidJack\DroidJack_lib\commons-codec-1.6.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
67d1eb17e3ef79a6e49b1d9213146266

SHA1
fce2af839401972df24eb8514025145d98a94c13

SHA256
7693faac68d6f7b668ed5484180f644e5cfb0c798847d8da980b7647ee83f32f

SHA512
8c45aecded2ec9c6fb499bb2f5180f4845c9a615f54734c0bb82c0647110d8d5cc608b0733d34de388d0c95e27420eb5ea4e506408ff9f7158bcb1a1c9b77df2

Download Submit
memory/1356-2-0x000002508A030000-0x000002508A2A0000-memory.dmp

Filesize
2.4MB

Download
memory/1356-11-0x000002508A010000-0x000002508A011000-memory.dmp

Filesize
4KB

Download
memory/1356-13-0x000002508A030000-0x000002508A2A0000-memory.dmp

Filesize
2.4MB

Download