d63dd4948fad38d69a210d89037d16db988985c0807846fd2702028e80a6f002

Analysis

max time kernel
1222s
max time network
1596s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
24/01/2024, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baritone-1.20.4.jar
Size

1.5MB
MD5

0d95133b6cbbf1b8f0353ac072c8b30f
SHA1

2ec64494dcbd76153e6555dbce1dc0ac6a702e69
SHA256

d63dd4948fad38d69a210d89037d16db988985c0807846fd2702028e80a6f002
SHA512

331cb8192d134f5ddaa713cb0ccbccb925402ed7ec5c9c4f5bf1d141749c3f6696729e07ec757cd12470e69adc84dfdedb16cb6f2e21307425049566c09de652
SSDEEP

24576:HVfD4CXVFM47++5WA8xKYuizJnLOsM80jfau/fEdsaUr855t3JUCV5hOLK/gtgx:1rxvMU5I/zJLOsMLZAaiDWo5hUKEe

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3384	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 3384	4344	java.exe	76
PID 4344 wrote to memory of 3384	4344	java.exe	76

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\baritone-1.20.4.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
b0224287cf0335b3f8edfcaebd58c0c6

SHA1
8980b1f6be55a4840b33150802ae8a14d0f4ba91

SHA256
481b2b195d03afb49f6cf250414ac67aa24527211655560c16c62f4817f072ec

SHA512
1d0c729b66ef42a0303312a516ba16b50ba107c7c4f1f7cd2d76dc32610c89c47e9e1b6aa91f9bacd288fa09a3cac1b8d52ae9ff0d0d66633c4a6213eb53ba72

Download Submit
memory/4344-4-0x00000168D65C0000-0x00000168D75C0000-memory.dmp

Filesize
16.0MB

Download
memory/4344-12-0x00000168D4DD0000-0x00000168D4DD1000-memory.dmp

Filesize
4KB

Download