bfe0ebe9b41a67d6780ed4e744354f7df03bedaf39dd9a8c24a6ba8b1106b4ac

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DroidJack/DroidJack_lib/commons-logging-1.1.1.jar
Size

59KB
MD5

ed448347fc0104034aa14c8189bf37de
SHA1

5043bfebc3db072ed80fbd362e7caf00e885d8ae
SHA256

ce6f913cad1f0db3aad70186d65c5bc7ffcc9a99e3fe8e0b137312819f7c362f
SHA512

470323a2ee38be1b7ff8c84f1f5a5f8c4ec2ceb6b0649faa7b961f111865877dbe125409f72b1c52c7f18aa89e3469635c49ff4b83f86cc2f2eb2cc5562f9bff
SSDEEP

768:Jirg+Y5XjlrZKpQHBSSfqKeR5r8WuwjK+imOU4MYgArhR0S9mNIHZ8LwyEOuHwIx:EAXjqrSiKm8XrQMr0S9mqH+wyEpQIx

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2548	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2548	2732	java.exe	85
PID 2732 wrote to memory of 2548	2732	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DroidJack\DroidJack_lib\commons-logging-1.1.1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
5d2ac5a303713cd8d94023bcf9a35090

SHA1
7a7c640e3c791ed36cfdce670ea802497af0c090

SHA256
1fa3eeb0b17dfc0dc39595d38ef5fd87cc70f87202630dd88faec9ebe17e8f0f

SHA512
1827fcf7bed0ddad294a352f00c0a0f1280112d57d707c79ecd678f5a486684b34f378548128814de01a2c3f93dda32752175e4e059063a5afa06cdcc8c73cc7

Download Submit
memory/2732-2-0x0000020080000000-0x0000020080270000-memory.dmp

Filesize
2.4MB

Download
memory/2732-12-0x00000200F2FA0000-0x00000200F2FA1000-memory.dmp

Filesize
4KB

Download
memory/2732-13-0x0000020080000000-0x0000020080270000-memory.dmp

Filesize
2.4MB

Download