561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
310s
max time network
386s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/jsse.jar
Size

619KB
MD5

fd1434c81219c385f30b07e33cef9f30
SHA1

0b5ee897864c8605ef69f66dfe1e15729cfcbc59
SHA256

bc3a736e08e68ace28c68b0621dccfb76c1063bd28d7bd8fce7b20e7b7526cc5
SHA512

9a778a3843744f1fabad960aa22880d37c30b1cab29e123170d853c9469dc54a81e81a9070e1de1bf63ba527c332bb2b1f1d872907f3bdce33a6898a02fef22d
SSDEEP

6144:ABoQeW0HKwYGORU+ehqEmke1WEAibVR0GPs4j8GgflXhuuMAjYDTj:Uo40WGdNmpb3DP75

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4244 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 656 wrote to memory of 4244 656 java.exe icacls.exe
PID 656 wrote to memory of 4244 656 java.exe icacls.exe

pid	process
4244	icacls.exe

description	pid	process	target process
PID 656 wrote to memory of 4244	656	java.exe	icacls.exe
PID 656 wrote to memory of 4244	656	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\jsse.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4244

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
345bc46cf421a4c99ad17283fe5b5280

SHA1
6f229d38f40388d2b1bcf5cdaa2b57a58cbde620

SHA256
48bfd542ee0329eec759e891265b6aab521959259dfacd83036a1f363e58f9f8

SHA512
9591585326a05c841501410632a51323281c2b0880fee25422aa5ac2a5c6a47ea1b84b6a50b8a7f3f9b079b09d522670eb328b234c633b797e763cc164404bdd

Download Submit
memory/656-2-0x000001CA48B60000-0x000001CA48DD0000-memory.dmp

Filesize
2.4MB

Download
memory/656-12-0x000001CA47500000-0x000001CA47501000-memory.dmp

Filesize
4KB

Download
memory/656-13-0x000001CA48B60000-0x000001CA48DD0000-memory.dmp

Filesize
2.4MB

Download