89017a73a5281e755d15cb33303bbf8454654941db813fa634d733df98363899

Analysis

max time kernel
132s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

platformBinary32/bin/apktool.jar
Size

19.0MB
MD5

4161cdad59718f81740d0727c9683819
SHA1

f008c1dad484ddbe682f0e003a046559e753bad2
SHA256

f750a3cd2c1f942f27f5f7fd5d17eada3bdaff0a6643f49db847e842579fdda5
SHA512

4200be3aa8923ff4af17c1cc831e228ccdbf377f47c082f8a7d45ac8ca950f0c3354072ef986e1947daf25531e153973872de4fc52d8cfee5ee100bdd3283d70
SSDEEP

393216:OkyM39U9Rt5D66rAzKFNf514GqUL3gYutKJzZWhkvOA8iSeo:OHYU54KFXztLhutKFi4Seo

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3960	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3960	1672	java.exe	95
PID 1672 wrote to memory of 3960	1672	java.exe	95

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\apktool.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-2-0x000002A3840A0000-0x000002A384310000-memory.dmp

Filesize
2.4MB

Download
memory/1672-11-0x000002A3827C0000-0x000002A3827C1000-memory.dmp

Filesize
4KB

Download
memory/1672-17-0x000002A3827C0000-0x000002A3827C1000-memory.dmp

Filesize
4KB

Download
memory/1672-18-0x000002A3840A0000-0x000002A384310000-memory.dmp

Filesize
2.4MB

Download