Analysis

  • max time kernel
    138s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 19:53

General

  • Target

    libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar

  • Size

    1.1MB

  • MD5

    358110bc2e443ee17791b6dd4c6ac75b

  • SHA1

    9c6c59b742d8e038a15f64c1aa273a893a658424

  • SHA256

    4a6a90ed956609d6cd3a7f84622fcac87d22e9a5d4858c6d1e965af860d07a63

  • SHA512

    5ffbcb54c6590fc083f5e4cad304b546805413dae25da13d7fa86f44a81e6d100c4e29783b715a3b14d39860dc10414557a58898981f6edc5ef658c3ae0d429c

  • SSDEEP

    24576:z4NvaydxrSk0+vPz73136oEbdm9mDL3ud5tN9+heY41uGIE:zeHdpN02P/136o4Cm/k5t6hziuGIE

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\libraries\com\mojang\realms\1.7.59\realms-1.7.59.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1860

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

          Filesize

          46B

          MD5

          8fc3c1d43ad8d91ebcfd497fc31cba77

          SHA1

          15043bba93bbe51f9be91fe04814b9832318ad1d

          SHA256

          856c5e95bbbd95eb4ff21e5252fd3eda59c5f26006b66ea69f0e8a5bf2a8b672

          SHA512

          f8c1b48e47dd77c0abd2585f7203536f3974a4ca39decc3e166b3923978176e8d6955f8dba21b53522a19d7e5f7e0911e4f2da4e97de8d226ff61892ccd5fb62

        • memory/3508-2-0x000001CCEFA90000-0x000001CCF0A90000-memory.dmp

          Filesize

          16.0MB

        • memory/3508-12-0x000001CCEFA70000-0x000001CCEFA71000-memory.dmp

          Filesize

          4KB