561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
310s
max time network
405s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/management-agent.jar
Size

381B
MD5

b608d45dcdd7a4cad6a63a89a002f683
SHA1

f6e3bb7050c3b1a3bed9b33122c4a98e6b9a810d
SHA256

52ca96531445b437dca524cb3714fcd8d70221d37a6b9c80f816713c3040dd0a
SHA512

407e7ca807826f0e41b085bca0f54f0134e3b9ac16fa5480ede02774067dad46aa07d225ba2981dec2a7297ea57721eab8c54e8bed83d352ec6c00abfdbbf626

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3120 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2720 wrote to memory of 3120 2720 java.exe icacls.exe
PID 2720 wrote to memory of 3120 2720 java.exe icacls.exe

pid	process
3120	icacls.exe

description	pid	process	target process
PID 2720 wrote to memory of 3120	2720	java.exe	icacls.exe
PID 2720 wrote to memory of 3120	2720	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\management-agent.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3120

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
7c6669bd9dcb57b1fc41b748c61dd328

SHA1
5b7fa133c2fbfd12c257dc3ef8bf1d73cdf9e9b9

SHA256
79a17901cb887700a3cbf623ac8c238179fb2396ea57a30f12adb675f97e4bd3

SHA512
dc1a3285c9bd5dd693457bd1cf9a9855aefa54a3ea835007462032431d7edfa00021faa22a49d9a24f3306b50ca4d1fbe24e7c21bf3f93822c820b1fe228ae1b

Download Submit
memory/2720-2-0x00000173887B0000-0x0000017388A20000-memory.dmp

Filesize
2.4MB

Download
memory/2720-12-0x0000017386D60000-0x0000017386D61000-memory.dmp

Filesize
4KB

Download
memory/2720-13-0x00000173887B0000-0x0000017388A20000-memory.dmp

Filesize
2.4MB

Download