Analysis

  • max time kernel
    90s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 19:53

General

  • Target

    libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar

  • Size

    18KB

  • MD5

    93730cef2e75762c5a1431c6d7a0c78e

  • SHA1

    73e80d0794c39665aec3f62eee88ca91676674ef

  • SHA256

    107d11509f6af59b8c2ba23df828bc5d3c4e067b58f3d858c7deb90ca5308f84

  • SHA512

    0e0956a0c16943c3bbeee89b17a556b2f4a57e7d87db1bca2449a77517c46559f4b2dcb541695f89693fedb533e627671466915758dd0f0299477bf374a58dc8

  • SSDEEP

    384:O2/pcGf9gGBkuFKfPfznT+CMpKfPMc77Jh4HDOobTYR3IWO/t2WEfF+/jgWlfuUW:O8pcGFgYkuFieCM+H4HCR3IWgt2B9+/o

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\libraries\com\paulscode\librarylwjglopenal\20100824\librarylwjglopenal-20100824.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1464

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

          Filesize

          46B

          MD5

          24e722166619b63072ee16c0079c1c46

          SHA1

          c82e3cd50e710b4c2d9d3bb4fa9dd85e90cefd5f

          SHA256

          4ffea53a8a9090251b9b9f16cd64bf7f487a08f18ffc081bd09ec5c5e554d8f8

          SHA512

          6bdb848d90e919c63274de7398932b432b1e10f2ade6aa73636cc530e099ae06b9c539b07e4eb8f84b5216c7ebc15b125a5e94305f10cec77a28eb38cc074547

        • memory/1484-4-0x0000020736520000-0x0000020737520000-memory.dmp

          Filesize

          16.0MB

        • memory/1484-11-0x0000020734C50000-0x0000020734C51000-memory.dmp

          Filesize

          4KB