85c9b01515c4f19f797d8753d7187f463b3c742012bd22d3ea84c222ea7f5a76

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MultiMC/jars/NewLaunch.jar
Size

14KB
MD5

9395a802a45948d7bdbefc03a563b92c
SHA1

c92d9515b5995e5ad5816f4635f336089e33bef6
SHA256

255ac2b99904cad700504d01881ae0d018ec313d5317de1609101d2c8e57b83c
SHA512

4d05b5e20c7a32e7c3d3f39e673c67614c99964fc8be4c5ba37c4ac4b690ef4a6093918bc2e9577635a3bb1196d5fea34763ec337722fb346089fd6ef744d5dc
SSDEEP

384:JCoBnP8jJ7Gtj2ljbvewrATIKzGC5XbAQiiQhNocSnvct017bczv:MAPrgNbmN8KiCFbVJQhNocXFr

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1956	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1956	3200	java.exe	84
PID 3200 wrote to memory of 1956	3200	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\MultiMC\jars\NewLaunch.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c0c5626816a3ffe2b8b31a94c9acf2ae

SHA1
c2fc5315cdac9d8af8d58a7596032d34a5b6ab9b

SHA256
33ceab216b6656095972876743f6236790a3230b6766c7fd9bf3b649bc281e65

SHA512
1fda69b97c8a12a4d069e22c3acf42ee723dfddafbef99b72a648570a1430a1084a538090ccf3e65164d5298da29dbecd7f74b6063a47e38d2014c4d1ecf3a0d

Download Submit
memory/3200-4-0x0000022CD5250000-0x0000022CD6250000-memory.dmp

Filesize
16.0MB

Download
memory/3200-12-0x0000022CD5230000-0x0000022CD5231000-memory.dmp

Filesize
4KB

Download
memory/3200-14-0x0000022CD5250000-0x0000022CD6250000-memory.dmp

Filesize
16.0MB

Download