bfe0ebe9b41a67d6780ed4e744354f7df03bedaf39dd9a8c24a6ba8b1106b4ac

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DroidJack/DroidJack_lib/jaad-0.8.4.jar
Size 653KB
Sample240602-tf86caha53
SHA256 be6ba7919a20f602703536e343860c2ae74ad18da195fd845743b877dbb379f7
MD5 4c09aa32e036530d42319aec289928a7
SHA1 f6617d5b95437557042e2d21f2b49121174ac80d
SHA512 d1ee7d5d1f5c8599bfa1eaf779e29033768c92e56cc69c9d30d809ad4b41ba9bfcd616af2f8cb3b7e00bab2b2626dfc0d46b78ed072d933d200e801b70c888ea
SSDEEP 12288:l0baMUzCKol2XKnbywMnCrR+7UZYVw7hHRNBeH3Q6dKncq:WeMUmKqoKn2RClmyYsRDqbdKncq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1532	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1532	2568	java.exe	84
PID 2568 wrote to memory of 1532	2568	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DroidJack\DroidJack_lib\jaad-0.8.4.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 07dbe76b486654810a6a99ed71e5cd9470346940b819e383b90bb54e71db1d02
MD5 4b6e1a964534cfdafaf508ea8d0e9076
SHA1 8ec02180a921e6bc8eae0a8da8ae66529e18acc4
SHA512 04ed5cf1677cf16f49418452f4816754cbfca86e09c924535fb8851d2c6aec5a5ff41f87a0a065cfb91787920d084a24e920e6dc078a5440fa2f307ff8194420
MD5 SHA1 SHA512

Submit Download

memory/2568-2-0x0000029CBB5C0000-0x0000029CBB830000-memory.dmp

Download

memory/2568-12-0x0000029CB9D30000-0x0000029CB9D31000-memory.dmp

Download

memory/2568-13-0x0000029CBB5C0000-0x0000029CBB830000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads