bfe0ebe9b41a67d6780ed4e744354f7df03bedaf39dd9a8c24a6ba8b1106b4ac

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DroidJack/Apktool/apktool.jar
Size

7.9MB
MD5

90abfb0564325cb20e6fb40d1ee4b787
SHA1

016be266e3e14eac8b54a8a994cf5e9ca439c160
SHA256

1920f046690932719ee1322739a77a2ca69acc9ea4162556b51601cc5465dd20
SHA512

d5e8ddb375b7e9e0bb04241dd2f98419551b0cddab861d6ec583ef2e0c8c50055425d0a8a411d40ab024b78c09ca809182b1f899bcbd6325d0ae7ff92dac8304
SSDEEP

196608:Y+bqB+7PsbNCKys6SjTJAvdPZpQe18MZGVOl2s:A+7Pess6SydfQcZGVOl2s

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1356	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1356	2688	java.exe	87
PID 2688 wrote to memory of 1356	2688	java.exe	87

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DroidJack\Apktool\apktool.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
df896feff82677b5846ee1ab1c94b32f

SHA1
534a5cc5882ee79848f54fbdf06fa151335dbdd3

SHA256
4be0c3c6a4442c3604eb6ba4881a815799af966c092fa0fa56c8c0b345e4c7c8

SHA512
8603092498035ff22d9c1d320cec1728f8b7fcc4593dcc162821df3638188503dae6f278fd984ab0a308f37b060af24f22b5c352b274e2327eeafebed6bad2b8

Download Submit
memory/2688-2-0x0000021FD6610000-0x0000021FD6880000-memory.dmp

Filesize
2.4MB

Download
memory/2688-12-0x0000021FD4DC0000-0x0000021FD4DC1000-memory.dmp

Filesize
4KB

Download
memory/2688-15-0x0000021FD4DC0000-0x0000021FD4DC1000-memory.dmp

Filesize
4KB

Download
memory/2688-16-0x0000021FD6610000-0x0000021FD6880000-memory.dmp

Filesize
2.4MB

Download