9424128833a503e72a27491b27e772139f5c5e078f7d7401048feb17e82f2fca

Analysis

max time kernel
75s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

features/jre.win32.win32.x86.feature_1.8.0.u171/jre/lib/jfr.jar
Size

547KB
MD5

52c22225436d6d2bae98bed13dc3d51a
SHA1

4b6c9249e518d2253768a2a01fdbc8ab8c252937
SHA256

97e62d44f307fe01288742092558b4a5bab02ee81e866a58fc02d1e5f9843899
SHA512

5846891aa0037b951c118373f43fc0f23472819c629fd60ea7fcee293dd96755a7e43dfb5ab9c4aeda760fd09e23018a0bd2eb59dfb2262221a257575c64960a
SSDEEP

12288:O5l+qU67FYWg+YWgYWeoXqgYSq8eh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7TQ5cS:O5l+qU67FYWg+YWgYWeoXqgYSq8eh2f+

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1816 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1780 wrote to memory of 1816 1780 java.exe icacls.exe
PID 1780 wrote to memory of 1816 1780 java.exe icacls.exe

pid	process
1816	icacls.exe

description	pid	process	target process
PID 1780 wrote to memory of 1816	1780	java.exe	icacls.exe
PID 1780 wrote to memory of 1816	1780	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\features\jre.win32.win32.x86.feature_1.8.0.u171\jre\lib\jfr.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6267194bb1dace6691418a98a1b295d8

SHA1
19611a2a994bb0f2163703fdf6786523300e6984

SHA256
1a03e33f5ef72af33c5b2d9ebcc6fd863007c65bbc3103ad7cd0c5025dad093e

SHA512
7efb5df63dc85aaab018feecbd9972bcdf95ca180efc675bcd1e699be097ee0196af6dc5b8f8337146b26815581c23d913949a503598af699346cfc53974a513

Download Submit
memory/1780-2-0x0000025CD4ED0000-0x0000025CD5140000-memory.dmp

Filesize
2.4MB

Download
memory/1780-12-0x0000025CD3610000-0x0000025CD3611000-memory.dmp

Filesize
4KB

Download
memory/1780-13-0x0000025CD4ED0000-0x0000025CD5140000-memory.dmp

Filesize
2.4MB

Download