Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/01/2024, 00:42

General

  • Target

    fabric-installer-0.11.2.exe

  • Size

    399KB

  • MD5

    0604fd84edc6059d39a631eb0ce5a546

  • SHA1

    9ecd7d7df70a25d5ba0ff81e7ad6b59280f71bb6

  • SHA256

    3c1029d521ba448c4150d58bd75fd1646f54d72d95d0f91f5dd60656f55eff9a

  • SHA512

    68e727ea4515ac385e4d757a5e6cff3005ccf50b54e7b5ee1bbb100f18afc09cd814138d31b9e4237a3170bbb3e4a9554e1b4294ec866cd6f63b6e461da8db09

  • SSDEEP

    6144:XbOTF9+lw27APRw3zeFAO8X+KAWCXgy/kJ1o2ww5OxLRfSA4syabpAq:L+z+u9ZF6uKAWCQy/c1HwnBBfL

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe
    "C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
      "javaw.exe" "-version"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:396
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:4576
    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
      "javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe" "-fabricInstallerBootstrap" "true"
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      PID:696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 300
      2⤵
      • Program crash
      PID:3904
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3068 -ip 3068
    1⤵
      PID:4892

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

      Filesize

      46B

      MD5

      868a460f21567d5b46a8b86ac6df8150

      SHA1

      3eefd45bd842daed6807966300a108642c382d6b

      SHA256

      b394a8345de6e7555a610d0e3990d000bbee916031ec7ede2a20ddee5476331c

      SHA512

      756ab4cf8e57b33bc16132cf90cb77fc82a0065fe5a4d41cd8853e516134bf4645d2e1879bb1db5c8a8476dfa51ae9bfe5ddaf2e4055aa4963fd22aa79fe3c1e

    • memory/396-4-0x00000289CA600000-0x00000289CB600000-memory.dmp

      Filesize

      16.0MB

    • memory/396-12-0x00000289CA5E0000-0x00000289CA5E1000-memory.dmp

      Filesize

      4KB

    • memory/396-41-0x00000289CA600000-0x00000289CB600000-memory.dmp

      Filesize

      16.0MB

    • memory/696-17-0x000002409C0A0000-0x000002409D0A0000-memory.dmp

      Filesize

      16.0MB

    • memory/696-25-0x000002409A7E0000-0x000002409A7E1000-memory.dmp

      Filesize

      4KB

    • memory/696-29-0x000002409A7E0000-0x000002409A7E1000-memory.dmp

      Filesize

      4KB

    • memory/696-35-0x000002409C0A0000-0x000002409D0A0000-memory.dmp

      Filesize

      16.0MB

    • memory/696-38-0x000002409C320000-0x000002409C330000-memory.dmp

      Filesize

      64KB

    • memory/696-39-0x000002409C330000-0x000002409C340000-memory.dmp

      Filesize

      64KB

    • memory/696-40-0x000002409C340000-0x000002409C350000-memory.dmp

      Filesize

      64KB

    • memory/696-42-0x000002409C0A0000-0x000002409D0A0000-memory.dmp

      Filesize

      16.0MB