9424128833a503e72a27491b27e772139f5c5e078f7d7401048feb17e82f2fca

Analysis

max time kernel
78s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dropins/eclipse/plugins/org.eclipse.core.contenttype.nl_it_4.2.0.v20130724060447.jar
Size

2KB
MD5

7088490ca658d8ab9399f0bc9a17dd1e
SHA1

e015393d2494739bb14adf0cdc8b7682e400bc6d
SHA256

ad6321ce645a80e50b0209d3ec5aa0402ea8568930c54629e0e1cdb2619f222b
SHA512

75a4d7a2b4f4f48c37e827ce9c70a37eef9aa2bd11587056b1ead274b37711370de32a62808d46690b848bf2be25ea2ff829f4dbf0fd592d670482883f1a508e

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2868 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3684 wrote to memory of 2868 3684 java.exe icacls.exe
PID 3684 wrote to memory of 2868 3684 java.exe icacls.exe

pid	process
2868	icacls.exe

description	pid	process	target process
PID 3684 wrote to memory of 2868	3684	java.exe	icacls.exe
PID 3684 wrote to memory of 2868	3684	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\dropins\eclipse\plugins\org.eclipse.core.contenttype.nl_it_4.2.0.v20130724060447.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
e982b2ebb6510e10ef7a4f9a3271c49d

SHA1
7bf44719dd1a5c835c6e2b9847eea7c825fcf836

SHA256
04de0f92b57d3db543e8b5a5275d2299ed5dad141a41a11948ce1fc5287bb2b1

SHA512
38ca0bfc51aa36c6591a2fd89e51fd237f1f0ecfeafc448178c6739c0d4911537a1d77406806e1d6a92ce90b9efbb5f331d8cde9fd2e5bd98e16df2c99c1e8cd

Download Submit
memory/3684-2-0x000001DE97410000-0x000001DE97680000-memory.dmp

Filesize
2.4MB

Download
memory/3684-12-0x000001DE95AA0000-0x000001DE95AA1000-memory.dmp

Filesize
4KB

Download
memory/3684-13-0x000001DE97410000-0x000001DE97680000-memory.dmp

Filesize
2.4MB

Download