561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
513s
max time network
527s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/javaws.jar
Size

465KB
MD5

5d8c1723f3005bd63dba2b478ce15621
SHA1

ab26a6167789dcf81a0c40d121dc91005804c703
SHA256

b637b78cfc33c92d4838d5fabfd0647ce03c3ef69d86ef6a7e6f229510aaf3b5
SHA512

9830ccdfe913a492bb4e0015ee3e729bea8ec1f22edf48ed7ce2aefd5376df24f33948b9155e31edfa9bc240544406fd2c43a34dd1366e4936b3318d3ca5ed1c
SSDEEP

12288:k4VtaECp5plmgYhuWvHuR9Ta/+Aw7okxygk+W:kUChlHYHMaHw7XxW

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1368 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4640 wrote to memory of 1368 4640 java.exe icacls.exe
PID 4640 wrote to memory of 1368 4640 java.exe icacls.exe

pid	process
1368	icacls.exe

description	pid	process	target process
PID 4640 wrote to memory of 1368	4640	java.exe	icacls.exe
PID 4640 wrote to memory of 1368	4640	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\javaws.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
39904c6f197a4ea57c069434226ebdb7

SHA1
d5bc19f603a9edae372cf8d0609a74f919620612

SHA256
12ec9118dd4b152865d92b19f12a76ff3253eee9bad02b06c83580e35f1fc666

SHA512
59ebf25e54921b39b99dae76a386a6505a09c744b30241d57e0af0d030f63ca036710b7049644f71f5d1214255f8a2e03ac1e3ef3d8e8d0c42e2e7df37c03e81

Download Submit
memory/4640-2-0x0000027C4FBA0000-0x0000027C4FE10000-memory.dmp

Filesize
2.4MB

Download
memory/4640-12-0x0000027C4E360000-0x0000027C4E361000-memory.dmp

Filesize
4KB

Download
memory/4640-13-0x0000027C4FBA0000-0x0000027C4FE10000-memory.dmp

Filesize
2.4MB

Download