bfe0ebe9b41a67d6780ed4e744354f7df03bedaf39dd9a8c24a6ba8b1106b4ac

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DroidJack/DroidJack_lib/jaad-0.8.4.jar
Size

653KB
MD5

4c09aa32e036530d42319aec289928a7
SHA1

f6617d5b95437557042e2d21f2b49121174ac80d
SHA256

be6ba7919a20f602703536e343860c2ae74ad18da195fd845743b877dbb379f7
SHA512

d1ee7d5d1f5c8599bfa1eaf779e29033768c92e56cc69c9d30d809ad4b41ba9bfcd616af2f8cb3b7e00bab2b2626dfc0d46b78ed072d933d200e801b70c888ea
SSDEEP

12288:l0baMUzCKol2XKnbywMnCrR+7UZYVw7hHRNBeH3Q6dKncq:WeMUmKqoKn2RClmyYsRDqbdKncq

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1532	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1532	2568	java.exe	84
PID 2568 wrote to memory of 1532	2568	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DroidJack\DroidJack_lib\jaad-0.8.4.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4b6e1a964534cfdafaf508ea8d0e9076

SHA1
8ec02180a921e6bc8eae0a8da8ae66529e18acc4

SHA256
07dbe76b486654810a6a99ed71e5cd9470346940b819e383b90bb54e71db1d02

SHA512
04ed5cf1677cf16f49418452f4816754cbfca86e09c924535fb8851d2c6aec5a5ff41f87a0a065cfb91787920d084a24e920e6dc078a5440fa2f307ff8194420

Download Submit
memory/2568-2-0x0000029CBB5C0000-0x0000029CBB830000-memory.dmp

Filesize
2.4MB

Download
memory/2568-12-0x0000029CB9D30000-0x0000029CB9D31000-memory.dmp

Filesize
4KB

Download
memory/2568-13-0x0000029CBB5C0000-0x0000029CBB830000-memory.dmp

Filesize
2.4MB

Download