ef624f858d383021283272addecd08514aa3f544dd219a525ff34106926b748f

Analysis

max time kernel
449s
max time network
1169s
platform
windows10-2004_x64
resource
win10v2004-20231222-es
resource tags

arch:x64arch:x86image:win10v2004-20231222-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/02/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client-1.20.3-1.20.1.jar
Size

11.1MB
MD5

68bf006edfec1d3487e6744dd914d8f1
SHA1

e22aea60914da437b3de1d703a82d90be1043584
SHA256

ef624f858d383021283272addecd08514aa3f544dd219a525ff34106926b748f
SHA512

907eaed58bf79cbc24dd754c97da6813f68ee631b02f1b5952094932427cd9113d3330988af501f4e0d58ea0010d4633b4e0942af4eaaf4f724244e65e0d5e37
SSDEEP

196608:wGOdgXtIx3JNRhSbFbQw0MBdbVteJPldk/2xRHb9zyp+29Tu1g42qBSaOt/H:qdgXa0bJQxulYW2xRHb9zypvGQ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2556	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2556	2148	java.exe	87
PID 2148 wrote to memory of 2556	2148	java.exe	87

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\client-1.20.3-1.20.1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4393c5daff02cb5fb3b7d4f7f295ae33

SHA1
a1672edd9df58c430563371275c6d27662d30de7

SHA256
1aa1d5cba4a3bfdbce9f40e317b5a8bc69dcbf2e5d8a565a9064aff19a6cd9cb

SHA512
dba3e6f762729e2144d2a71c52a5cbdc6496bb8698c255b91ced056ae2cf43c0801aafc16e4d74bdb59004d1e69c8c6159190d4715f48c2a61fede2f756995b5

Download Submit
memory/2148-4-0x0000018533410000-0x0000018534410000-memory.dmp

Filesize
16.0MB

Download
memory/2148-12-0x0000018531C40000-0x0000018531C41000-memory.dmp

Filesize
4KB

Download
memory/2148-13-0x0000018533410000-0x0000018534410000-memory.dmp

Filesize
16.0MB

Download