cdc19a726fc105afcb88d124aa015b67a05341c4e9e8bca9d2deee3f5d80c9cc

Analysis

max time kernel
190s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/08/2024, 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/jce.jar
Size

112KB
MD5

a39f61d6ed2585519d7af1e2ea029f59
SHA1

52515ac6deab634f3495fd724dea643ee442b8fd
SHA256

60724d9e372fbe42759349a06d3426380ca2b9162fa01eb2c3587a58a34ad7e0
SHA512

ac2e9ab749f5365be0fb8ebd321e8f231d22eae396053745f047fcbccf8d3de2f737d3c37a52c715addfbdbd18f14809e8b37b382b018b58a76e063efba96948
SSDEEP

1536:5sNJO+ylt6se6sgU0w/XzGYWuSy15DudYLSfaxwpt5g1naZEqwoJ8sYcF+z/VSG8:aj8GHXZSy1pudYLdQe1ATtKVS+ws9O

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4692	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4692	4592	java.exe	76
PID 4592 wrote to memory of 4692	4592	java.exe	76

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\jce.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
fc4293ac3f58ce2094456b52a276a970

SHA1
c223349a4a5fbf4354ed7b61c4c794b463d2c9ea

SHA256
aed815de3fdab375ef28f1d3af8680991c0196ed7701ffd73e9cf60e016cfc7c

SHA512
5b9e123ab3f881789d88d96f1358dca00817e6e03f89204cdd29a006a0626d517c06ab1bb0ddb35ed1df2f3a003e23cd13c049dd0e064a98a116661e01804c5e

Download Submit
memory/4592-2-0x000001B72F370000-0x000001B72F5E0000-memory.dmp

Filesize
2.4MB

Download
memory/4592-12-0x000001B72DD30000-0x000001B72DD31000-memory.dmp

Filesize
4KB

Download
memory/4592-13-0x000001B72F370000-0x000001B72F5E0000-memory.dmp

Filesize
2.4MB

Download