Exploit payload process blocked - JAVA.exe

[JAWS98]

Hi,

After upgrading JAVA on our Library server (due to upgrade of Library Software), every day or so we are getting the below error message reported by Malwarebytes, is this a false positive or something to be worried about?

I have run a full scan on the server and nothing is found as suspicious.

It started with just one process found, the last report reported 12 instances of the same process as exploit.  Is this because the Library Software is using JAVA and Malwarebytes believes it is under attack?

 

Exploit threat detected, see details below:

31/05/2018 16:57:51   Exploit payload process blocked BLOCK   C:\Windows\SYSTEM32\cmd.exe \c dir C:\   SYSTEM Java   C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe        Attacked application: C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe; Parent process name: java.exe; Layer: Application Behavior Protection; API ID: 207; Address: ; Module: ; AddressType: ; StackTop: ; StackBottom: ; StackPointer: ; Extra:

Further to this, if I go on to the server and run the Library Software (Access-It), which requires JAVA to run, Malwarebytes does not detect any issues, the server was fine before I upgraded, just wondering if it is becase the JAVA version installed was through the installer and not through JAVA itself.

James

Edited June 1, 2018 by JAWS98
Updated Details

[Rsullinger]

Hey Jaws98,

 

What is causing it is hard to say, but our program is blocking it because java is attempting to run a cmd/script of some sort. We don't care what it is running, just that it is trying to make that type of call. Just from that piece of code it doesn't look malicious. Just to be safe, you may want to try re-installing the java software and get it on the latest to see if it still occurs.