c91fd606e8ec34477f7d8380b41ec50f00165eac31cea01801f169899d74dedf

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MALWARE-NEW-Melody Mod (1.8.9).jar
Size

3KB
MD5

133f199b196c7be68433970bec381567
SHA1

21c0141602c79f41f9ffe23bff3d3008dad5bee6
SHA256

c91fd606e8ec34477f7d8380b41ec50f00165eac31cea01801f169899d74dedf
SHA512

af58664fbab5998d57507fb157048fc6e450552f11b64e2a812476199da9c2c59f9dbcd1e2e4b7e64928c9320bc61ccdabe89853f76191617d14afe36433a82d

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2564	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2564	3384	java.exe	89
PID 3384 wrote to memory of 2564	3384	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\MALWARE-NEW-Melody Mod (1.8.9).jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
a7068e96f67ed29ad9b34c52f0259209

SHA1
16f1b6fab8e881d87fb4ec8232ab2d7e18ece1ec

SHA256
fd3fd0d281b73f9b5ea235e73b42becacfa602730700c0dfe345ad06d8e0ebc1

SHA512
9a1530e56b853ec9c0b021287004c575a208dddedf5c71f1697a6bd91680a244fcef29cb38866c1235c0ab9a6e7f277f0fe48561c3926daebb627b3b9db8a792

Download Submit
memory/3384-4-0x000002281C1F0000-0x000002281D1F0000-memory.dmp

Filesize
16.0MB

Download
memory/3384-12-0x000002281C1D0000-0x000002281C1D1000-memory.dmp

Filesize
4KB

Download