bfe0ebe9b41a67d6780ed4e744354f7df03bedaf39dd9a8c24a6ba8b1106b4ac

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DroidJack/DroidJack_lib/httpcore-4.2.4.jar
Size

221KB
MD5

6ccb86231d8a8b99c551b4ddf926ddd1
SHA1

3b7f38df6de5dd8b500e602ae8c2dd5ee446f883
SHA256

bda2b9e0464f7a0e122d5e9bff7b384f3bc3a91af18ad51e029deaaa599e5db3
SHA512

0c4de4513cafb13a81bcad7cc1a4e45759ba32654eafde15665afde63a427b04ac25cfe17e4bbd1887225960b5aaf7e73382e35ec16993dbc1fd19a2bf5e8ab9
SSDEEP

6144:mjj5oIwPj1CM0oifaJtv27fxnNibFx992P0SfMPlJ:mRoZPjuwgRNUIPTW

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1896	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 1896	3668	java.exe	85
PID 3668 wrote to memory of 1896	3668	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DroidJack\DroidJack_lib\httpcore-4.2.4.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
61cbf0e233f1dd4cce8f61a949e3c1c1

SHA1
ecf8c57bd51fd347a371533afc9724fe7685625b

SHA256
46eec68a4c13521cc948cbc62107cf68081b0865c1885eeb2258ed372fd3fd20

SHA512
6d7dbcf125b0ce9bb1572513b441db98ee6e062f2b10e06721832cc06e02e7c6ad3471973a3897f0c5230b96321b8c51800905b82ae9df5988c2bfdf8e0a8f06

Download Submit
memory/3668-2-0x00000169D80C0000-0x00000169D8330000-memory.dmp

Filesize
2.4MB

Download
memory/3668-11-0x00000169D80A0000-0x00000169D80A1000-memory.dmp

Filesize
4KB

Download
memory/3668-13-0x00000169D80C0000-0x00000169D8330000-memory.dmp

Filesize
2.4MB

Download