bfe0ebe9b41a67d6780ed4e744354f7df03bedaf39dd9a8c24a6ba8b1106b4ac

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DroidJack/DroidJack_lib/commons-logging-1.1.1.jar
Size 59KB
Sample240602-tf86caha53
SHA256 ce6f913cad1f0db3aad70186d65c5bc7ffcc9a99e3fe8e0b137312819f7c362f
MD5 ed448347fc0104034aa14c8189bf37de
SHA1 5043bfebc3db072ed80fbd362e7caf00e885d8ae
SHA512 470323a2ee38be1b7ff8c84f1f5a5f8c4ec2ceb6b0649faa7b961f111865877dbe125409f72b1c52c7f18aa89e3469635c49ff4b83f86cc2f2eb2cc5562f9bff
SSDEEP 768:Jirg+Y5XjlrZKpQHBSSfqKeR5r8WuwjK+imOU4MYgArhR0S9mNIHZ8LwyEOuHwIx:EAXjqrSiKm8XrQMr0S9mqH+wyEpQIx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2548	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2548	2732	java.exe	85
PID 2732 wrote to memory of 2548	2732	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DroidJack\DroidJack_lib\commons-logging-1.1.1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 1fa3eeb0b17dfc0dc39595d38ef5fd87cc70f87202630dd88faec9ebe17e8f0f
MD5 5d2ac5a303713cd8d94023bcf9a35090
SHA1 7a7c640e3c791ed36cfdce670ea802497af0c090
SHA512 1827fcf7bed0ddad294a352f00c0a0f1280112d57d707c79ecd678f5a486684b34f378548128814de01a2c3f93dda32752175e4e059063a5afa06cdcc8c73cc7
MD5 SHA1 SHA512

Submit Download

memory/2732-2-0x0000020080000000-0x0000020080270000-memory.dmp

Download

memory/2732-12-0x00000200F2FA0000-0x00000200F2FA1000-memory.dmp

Download

memory/2732-13-0x0000020080000000-0x0000020080270000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads