CmdID

CmdID / Files

java.exe

OpenJDK Platform binary file version info

Program on Windows 16 known copies with hashes 12 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real java.exe?

file version info and known copies
Installed inC:\program files (x86)\AdoptOpenJDK\jdk-8.0.265.01-hotspot\bin\
C:\program files (x86)\AdoptOpenJDK\jdk-8.0.265.01-hotspot\jre\bin\
C:\program files (x86)\AdoptOpenJDK\jre-8.0.265.01-hotspot\bin\
Signed byLondon Jamocha Community CIC
ProductOpenJDK Platform 8, AdoptOpenJDK
DescriptionOpenJDK Platform binary

16 known copies

11.0.8 · C:\program files\AdoptOpenJDK\jdk-11.0.8.10-hotspot\bin\java.exe · signed by London Jamocha Community CIC

1b3abe3a94a74aaa98f352f943ea1ebed7ab749d63219cbc956819f24e2e6971

11.0.8 · C:\program files\Amazon Corretto\jdk11.0.8_10\bin\java.exe · signed by Amazon.com Services LLC

57c15243d554074a1f066cd3d767f501b28e9bdf10744835b41665319744f79e

11.0.8 · C:\program files\AdoptOpenJDK\jre-11.0.8.10-hotspot\bin\java.exe · signed by London Jamocha Community CIC

78bd4e4effface488db69bb61f4c7cc5b2a0035b3a8fd9967db445fcafa22e40

8.0.2650.1 · C:\Program Files\Amazon Corretto\jdk1.8.0_265\jre\bin\java.exe · signed by Amazon.com Services LLC

228027fdf00abbfb917bc67f58d67fe26f56b19869deac4e548c42005d7e3614

8.0.2650.1 · C:\program files (x86)\AdoptOpenJDK\jdk-8.0.265.01-hotspot\bin\java.exe · signed by London Jamocha Community CIC

417e5de0548dfe9b62043e841fe997dd48a25168243edea0adea7e8545c5612e

8.0.2650.1 · C:\program files (x86)\Amazon Corretto\jdk1.8.0_265\bin\java.exe · signed by Amazon.com Services LLC

448c55f8296cf380e3ad3541757ca69ba8c6b18d51665b64642d4cb361949d25

8.0.2650.1 · C:\program files (x86)\Amazon Corretto\jre8\bin\java.exe · signed by Amazon.com Services LLC

54cc38644b53f1812de5a71f2463c79d9e2a876e42f66e8c27e37833f2cfa4a3

8.0.2650.1 · C:\program files (x86)\Amazon Corretto\jdk1.8.0_265\jre\bin\java.exe · signed by Amazon.com Services LLC

6221427b0ce8e35970237159451e657e1f751d3eaa7d799c148b59670afa957b

8.0.2650.1 · C:\Program Files\AdoptOpenJDK\jre-8.0.265.01-hotspot\bin\java.exe · signed by London Jamocha Community CIC

67aa49eea8c6bd318c4e336535b918127d6ceb1a5470e9c2fadba313ceb24ace

8.0.2650.1 · C:\Program Files\Amazon Corretto\jre8\bin\java.exe · signed by Amazon.com Services LLC

ac37b12c11040e25a10aadd48ca1c77e74323990f200a0b9464398e290c3b208

8.0.2650.1 · C:\Program Files\AdoptOpenJDK\jdk-8.0.265.01-hotspot\jre\bin\java.exe · signed by London Jamocha Community CIC

c1ceb7f3dafe627bd44d7bf67632a3da4cf0b6e720453c0f70ccd1141ef08fd3

8.0.2650.1 · C:\Program Files\AdoptOpenJDK\jdk-8.0.265.01-hotspot\bin\java.exe · signed by London Jamocha Community CIC

d5677c7117f8212b85a2e6ffc9bc05c4c5b15957f38429cb36d1e1aadfb9f82d

8.0.2650.1 · C:\program files (x86)\AdoptOpenJDK\jdk-8.0.265.01-hotspot\jre\bin\java.exe · signed by London Jamocha Community CIC

e3ab92350148a72ff568f790b42660251b2cc3b2a3976821c3d636b5a3b76fe0

8.0.2650.1 · C:\Program Files\Amazon Corretto\jdk1.8.0_265\bin\java.exe · signed by Amazon.com Services LLC

e649aa5fb3aef54ef6ff651833adb6dfc747aab3db14abcc5feef16fad6d88ec

8.0.2650.1 · C:\program files (x86)\AdoptOpenJDK\jre-8.0.265.01-hotspot\bin\java.exe · signed by London Jamocha Community CIC

e6585ffda88fdfeba0b941372799ed846d53f9d0c96b1dc783e4e7327abd1be9

8.0.1710.11 · C:\ProgramData\Oracle\Java\javapath\java.exe · signed by Oracle America

8f957b71c0e38f4f19d02fca3584b3ab42b434f097b849d289b8b00473961063

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name java.exe
highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)
highPotential Atlassian Confluence CVE-2021-26084 Exploitation AttemptBhabesh Raj
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Child Process of SolarWinds WebHelpDeskHuntress Team, Swachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems)
highWebshell Tool Reconnaissance ActivityCian Heasley, Florian Roth (Nextron Systems)
mediumShell Process Spawned by Java.EXEAndreas Hunkeler (@Karneades), Nasreddine Bencherchali

Sigma names java.exe in 12 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.