9424128833a503e72a27491b27e772139f5c5e078f7d7401048feb17e82f2fca

Analysis

max time kernel
77s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

features/jre.win32.win32.x86.feature_1.8.0.u171/jre/lib/resources.jar
Size

3.3MB
MD5

eb9b47383ae1e00f7e8ad516e218f761
SHA1

9124f573c3e4e1f10edc06d8ed59b0139c9cb993
SHA256

fd8409b40830a163f62c09e9ccaf4ba8938ee5b7f7ec2c5d58d0ca1825a9d74e
SHA512

f115155734ef373a5ac48be3a40f13b002fc3c8586bc5aeef09c2f0eab49e7c333252512009705b497597f1e812b2ed496f1d12619d6a30fa517ea01b311bf1a
SSDEEP

49152:NihqryI8TKxcUhjmjLKemY/o2y5gXuNd1XyGRmjQ5BicZjgw21wuz40Ydlodjrbx:Y5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1156 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4892 wrote to memory of 1156 4892 java.exe icacls.exe
PID 4892 wrote to memory of 1156 4892 java.exe icacls.exe

pid	process
1156	icacls.exe

description	pid	process	target process
PID 4892 wrote to memory of 1156	4892	java.exe	icacls.exe
PID 4892 wrote to memory of 1156	4892	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\features\jre.win32.win32.x86.feature_1.8.0.u171\jre\lib\resources.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6fb0622b9eaa7c3b8c5173af5269f1a0

SHA1
3ccc879c7864ade14d3a2ab7f34d4e0d8f35915c

SHA256
fe0173867b42cf65ab564ac241a5015d4e18260a0fcd3cd8350b84a83ec15be2

SHA512
f018061c8ab1973abeb0ec663056c0a37658c172bba705bb7cad39f2f3774fd1522229d7a485201ae934304283a2cea0bdbcdccc66f9ff2ef638ddb395c25afc

Download Submit
memory/4892-2-0x0000023380000000-0x0000023380270000-memory.dmp

Filesize
2.4MB

Download
memory/4892-12-0x00000233FB330000-0x00000233FB331000-memory.dmp

Filesize
4KB

Download
memory/4892-13-0x0000023380000000-0x0000023380270000-memory.dmp

Filesize
2.4MB

Download