Overview
overview
7Static
static
3libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/....2.jar
windows7-x64
1libraries/....2.jar
windows10-2004-x64
7libraries/...21.jar
windows7-x64
1libraries/...21.jar
windows10-2004-x64
7libraries/....8.jar
windows7-x64
1libraries/....8.jar
windows10-2004-x64
7libraries/...59.jar
windows7-x64
1libraries/...59.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...24.jar
windows7-x64
1libraries/...24.jar
windows10-2004-x64
7libraries/...07.jar
windows7-x64
1libraries/...07.jar
windows10-2004-x64
7libraries/....9.jar
windows7-x64
1libraries/....9.jar
windows10-2004-x64
7libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....3.jar
windows7-x64
1libraries/....3.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/...al.jar
windows7-x64
1libraries/...al.jar
windows10-2004-x64
7Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win10v2004-20240221-en
General
-
Target
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
-
Size
101KB
-
MD5
0d622e2ac4368b5a33d540a9e4819e0c
-
SHA1
c73b5636faf089d9f00e8732a829577de25237ee
-
SHA256
6c4b4e50e608763564afa1bde2d25ece9dd715e7c9129540faa1faded4896506
-
SHA512
304b55520c48d574cb046efa45687000b640937ea86119b81c152bfb192aded3de61b993bb83275e21efa4cf0f50efd3025d030b18dc1a0f53fed1dcdcb151f9
-
SSDEEP
1536:WD3fa3ic1NIqIZ8CYAEsNMFpdui0VH3Bq61a4D3r1j/mOQu6+5Gy+gvocWbRtaM5:OcsqLCvmLuvNRq61aal/mPuV5VxvAWF8
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3708 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4064 wrote to memory of 3708 4064 java.exe 87 PID 4064 wrote to memory of 3708 4064 java.exe 87
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\libraries\com\paulscode\codecjorbis\20101023\codecjorbis-20101023.jar1⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:3708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD582cb1eb387e9b3abb212ba4237b7007a
SHA168b9c5c28c5325e574ffca7b08b25585a99c8390
SHA256f9b6f9844e5fc105a1b29828b1809d4ba26ca738e29ef35fe4b0cb6be12b2723
SHA512aef6af4fac311fdef2e528a4b4926a4126be257b7cbae6fd038de5c312b21f98558c5d669f588a01846ec8c9f8f656b5507084601df14a9dd4a6bd1035ed75ab