561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
506s
max time network
517s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/jce.jar
Size

112KB
MD5

a39f61d6ed2585519d7af1e2ea029f59
SHA1

52515ac6deab634f3495fd724dea643ee442b8fd
SHA256

60724d9e372fbe42759349a06d3426380ca2b9162fa01eb2c3587a58a34ad7e0
SHA512

ac2e9ab749f5365be0fb8ebd321e8f231d22eae396053745f047fcbccf8d3de2f737d3c37a52c715addfbdbd18f14809e8b37b382b018b58a76e063efba96948
SSDEEP

1536:5sNJO+ylt6se6sgU0w/XzGYWuSy15DudYLSfaxwpt5g1naZEqwoJ8sYcF+z/VSG8:aj8GHXZSy1pudYLdQe1ATtKVS+ws9O

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2868 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4752 wrote to memory of 2868 4752 java.exe icacls.exe
PID 4752 wrote to memory of 2868 4752 java.exe icacls.exe

pid	process
2868	icacls.exe

description	pid	process	target process
PID 4752 wrote to memory of 2868	4752	java.exe	icacls.exe
PID 4752 wrote to memory of 2868	4752	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\jce.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
cfdb9d5b246d8b1f28012f096dcdf4ed

SHA1
aa673ce3ee03bc43467a76ff45368d7acdef2084

SHA256
b6f63dd4173f637b6b7e68ac0fe678e0f57756575fc01ba9cf9080da556f91b3

SHA512
19ccd87a02ec0dde1d8dcaa4204861a776274630e08f57ad43795fecae452f5c7845ee3a85ff12e9e969bca7e2405bf41f2b12c631e1125c8202d71bd5c38c59

Download Submit
memory/4752-2-0x0000021044AB0000-0x0000021044D20000-memory.dmp

Filesize
2.4MB

Download
memory/4752-12-0x0000021043230000-0x0000021043231000-memory.dmp

Filesize
4KB

Download
memory/4752-13-0x0000021044AB0000-0x0000021044D20000-memory.dmp

Filesize
2.4MB

Download