561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
311s
max time network
407s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/jfxswt.jar
Size

33KB
MD5

c401e00a5de0dd9723885cef9e2f5a44
SHA1

b6735b93811517f062a20869d8a0b57faeff6a90
SHA256

c6574f4763696f2a83028de143d9ed1c975062ba2d44cc5c91558751fb84bcd6
SHA512

595b950ad5bff930654bf7fb996ba222d19b4f175821ab0fd6ec4f54d4b7d62b37757429051d1302bc438ab76350b4cd0a07ba712caecc79dcdb0c60494b5ab2
SSDEEP

768:xYJfTGikW6VajSe/SA5vN9kqizE48ojVxQYuW+t:xY5TpkK/nFNIzptjVxYHt

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5072 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3124 wrote to memory of 5072 3124 java.exe icacls.exe
PID 3124 wrote to memory of 5072 3124 java.exe icacls.exe

pid	process
5072	icacls.exe

description	pid	process	target process
PID 3124 wrote to memory of 5072	3124	java.exe	icacls.exe
PID 3124 wrote to memory of 5072	3124	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\jfxswt.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3124

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:5072

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
d362e4fe88fb8121855754983dc65150

SHA1
a8c4fc7b567412d0fcdda6481ba820614e687430

SHA256
f787fce3c3427938456aa563466cf45f9d505cca8ea07845354b5abee7d1d2e6

SHA512
66f28abd484309414f193dad130edb9ed3449b27809555cd32867cbee57adaf6e8d1630dcc6bf38b3a6fcb50a377b986e00b74a0dfacf3cceff4f6ad98a2d2f6

Download Submit
memory/3124-2-0x000002DCAB7B0000-0x000002DCABA20000-memory.dmp

Filesize
2.4MB

Download
memory/3124-12-0x000002DCAB790000-0x000002DCAB791000-memory.dmp

Filesize
4KB

Download
memory/3124-13-0x000002DCAB7B0000-0x000002DCABA20000-memory.dmp

Filesize
2.4MB

Download