Overview
overview
7Static
static
3libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/....2.jar
windows7-x64
1libraries/....2.jar
windows10-2004-x64
7libraries/...21.jar
windows7-x64
1libraries/...21.jar
windows10-2004-x64
7libraries/....8.jar
windows7-x64
1libraries/....8.jar
windows10-2004-x64
7libraries/...59.jar
windows7-x64
1libraries/...59.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...24.jar
windows7-x64
1libraries/...24.jar
windows10-2004-x64
7libraries/...07.jar
windows7-x64
1libraries/...07.jar
windows10-2004-x64
7libraries/....9.jar
windows7-x64
1libraries/....9.jar
windows10-2004-x64
7libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....3.jar
windows7-x64
1libraries/....3.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/...al.jar
windows7-x64
1libraries/...al.jar
windows10-2004-x64
7Analysis
-
max time kernel
147s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win10v2004-20240221-en
General
-
Target
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
-
Size
63KB
-
MD5
6d9d7d6c163caf74984465694d3566e7
-
SHA1
419c05fe9be71f792b2d76cfc9b67f1ed0fec7f6
-
SHA256
2882d64550240dd0c026724da664d9f97ef205c91d6a85273d10790d88608f34
-
SHA512
8b5c995c3ba0b58f60269793418f3d52c766fa182c92bb76856b7bb7fb79e7c74eecea8d50fc1fac665328b00474851a8ea0c959373d84269e550ad1cb6e327c
-
SSDEEP
1536:23mMk864MtuifaWl5dpNaN7r7F19bsrHlpmruKhoR/lVdcGuce:j867FSWl7GNfL9ArHlpm3g6we
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2964 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3232 wrote to memory of 2964 3232 java.exe 87 PID 3232 wrote to memory of 2964 3232 java.exe 87
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\libraries\com\paulscode\soundsystem\20120107\soundsystem-20120107.jar1⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5b6ed51cbc00e991ef28f7bab79350129
SHA1de58c3b8c27565feefb84f303c3a0be5fe1cf0a5
SHA25662853665e141c6b4f7704af3379999c73dd88746225393810751191f331d4a20
SHA512f8dbe94cd4257e1113f362b4a88b9eb8fa6d6126046a606943443b15d798444048a0b3b79da44973160e1b0c07b3835ec70d0bd4e7f61467880bba5b01622a76