Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 19:53

General

  • Target

    libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar

  • Size

    15KB

  • MD5

    5da4cd5158f975d44952b929ce835b7c

  • SHA1

    0a796914d1c8a55b4da9f4a8856dd9623375d8bb

  • SHA256

    cae3de169e7695ef30079349c5ea81790bd10c04c4037196fd4fdc07b6d43934

  • SHA512

    b693efc64eae075cc0130d05382d671c080b704ed0ac9880ab76b253b235dc4d7df2b23c612a574f054bca498294343430d825fedb6cffee268b786b234fc120

  • SSDEEP

    192:3cIJ8c6w5BWHat4ZuFTP7gcCJHhhTIv9wAlZV2J7YgfNPW0Arc935g6itQuI/rB1:sEQHatc+PgcEnIv9s/NV6yW6imuI/P

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\libraries\com\mojang\netty\1.8.8\netty-1.8.8.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:4564

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

          Filesize

          46B

          MD5

          f0b4cfba0c1fb107974f595aa02f66f4

          SHA1

          c9d5002aca517fbfff1c7def8d493891b1df20b9

          SHA256

          18520d8597cd01b5453aacd1babf6aff1bc6e24cbe48ac2645f70a783518a42c

          SHA512

          df8690c031bd0055a598e70a3931aac2d995ba1a56885b4e98f3cac1e1ef1abdb50c6f71da3d58e84dfcbd8cf4f242ff65243bb00c586fa21a287f5919f07b16

        • memory/4864-4-0x00000261C7490000-0x00000261C8490000-memory.dmp

          Filesize

          16.0MB

        • memory/4864-11-0x00000261C7470000-0x00000261C7471000-memory.dmp

          Filesize

          4KB