Overview
overview
7Static
static
3libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/....2.jar
windows7-x64
1libraries/....2.jar
windows10-2004-x64
7libraries/...21.jar
windows7-x64
1libraries/...21.jar
windows10-2004-x64
7libraries/....8.jar
windows7-x64
1libraries/....8.jar
windows10-2004-x64
7libraries/...59.jar
windows7-x64
1libraries/...59.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...24.jar
windows7-x64
1libraries/...24.jar
windows10-2004-x64
7libraries/...07.jar
windows7-x64
1libraries/...07.jar
windows10-2004-x64
7libraries/....9.jar
windows7-x64
1libraries/....9.jar
windows10-2004-x64
7libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....3.jar
windows7-x64
1libraries/....3.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/...al.jar
windows7-x64
1libraries/...al.jar
windows10-2004-x64
7Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win10v2004-20240221-en
General
-
Target
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
-
Size
257KB
-
MD5
75615356605c8128013da9e3ac62a249
-
SHA1
9ce04e34240f674bc72680f8b843b1457383161a
-
SHA256
ad19d2601c3abf0b946b5c3a4113e226a8c1e3305e395b90013b78dd94a723ce
-
SHA512
b65531ead8500493e3dd14a860224851b80f438fc53bf8868b443a0557d839a2b0c868e4fedcf99579ae04b6b2bbd8cdb37f9921ad785983c37569aa9d2e8102
-
SSDEEP
6144:7P1UfNFAs0rRzuGrHfumymG2w63GhctKS/VTcbbNbIR:7P8AsoRNrHfumy1pRyQnNbY
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1988 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3824 wrote to memory of 1988 3824 java.exe 88 PID 3824 wrote to memory of 1988 3824 java.exe 88
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\libraries\commons-codec\commons-codec\1.9\commons-codec-1.9.jar1⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5a1b786efc64f4027987de1933d259a3e
SHA16f1865b9bcac7eb857cec30fc6a87010770a8b4b
SHA256b3e4a54696426f2a6f950faafd78d7c25bd52d1ca76b4f14f6bb775415f4f446
SHA512e7ebbc7e8183e5dc3afd2868f1b053803e16bf76e429be39441c46e23714ce690dcd805cbdb677b48a06ab97733f99d397721db3a6c651549cfe4364fa895bd1