561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
311s
max time network
377s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/security/local_policy.jar
Size

3KB
MD5

57aaaa3176dc28fc554ef0906d01041a
SHA1

238b8826e110f58acb2e1959773b0a577cd4d569
SHA256

b8becc3ef2e7ff7d2165dd1a4e13b9c59fd626f20a26af9a32277c1f4b5d5bc7
SHA512

8704b5e3665f28d1a0bc2a063f4bc07ba3c7cd8611e06c0d636a91d5ea55f63e85c6d2ad49e5d8ece267d43ca3800b3cd09cf369841c94d30692eb715bb0098e

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3012 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3832 wrote to memory of 3012 3832 java.exe icacls.exe
PID 3832 wrote to memory of 3012 3832 java.exe icacls.exe

pid	process
3012	icacls.exe

description	pid	process	target process
PID 3832 wrote to memory of 3012	3832	java.exe	icacls.exe
PID 3832 wrote to memory of 3012	3832	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\security\local_policy.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3012

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
772184ede3a93a9eba7e7dcaf315583b

SHA1
bf68e092f3d16077dd40380512d87af4cc4acdcb

SHA256
35e7dabd59fda5962cf40b50207ea7c982809df8f349ead0faafbc7b74989066

SHA512
158e9176af68fd8f0ed5b3cf037a9d55240e03a68308eed4ffd3eaf2a5a7b13e656aa6689157de0f0ebacb89428370043cf96ba2f71674e4cd2cef4ea78123d1

Download Submit
memory/3832-2-0x000002939C740000-0x000002939C9B0000-memory.dmp

Filesize
2.4MB

Download
memory/3832-12-0x000002939AE10000-0x000002939AE11000-memory.dmp

Filesize
4KB

Download
memory/3832-13-0x000002939C740000-0x000002939C9B0000-memory.dmp

Filesize
2.4MB

Download