Overview
overview
7Static
static
3libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/....2.jar
windows7-x64
1libraries/....2.jar
windows10-2004-x64
7libraries/...21.jar
windows7-x64
1libraries/...21.jar
windows10-2004-x64
7libraries/....8.jar
windows7-x64
1libraries/....8.jar
windows10-2004-x64
7libraries/...59.jar
windows7-x64
1libraries/...59.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...24.jar
windows7-x64
1libraries/...24.jar
windows10-2004-x64
7libraries/...07.jar
windows7-x64
1libraries/...07.jar
windows10-2004-x64
7libraries/....9.jar
windows7-x64
1libraries/....9.jar
windows10-2004-x64
7libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....3.jar
windows7-x64
1libraries/....3.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/...al.jar
windows7-x64
1libraries/...al.jar
windows10-2004-x64
7Analysis
-
max time kernel
93s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win10v2004-20240221-en
General
-
Target
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
-
Size
1.6MB
-
MD5
aec124acf7b3c1c6ed41a6270a4452b8
-
SHA1
63d216a9311cca6be337c1e458e587f99d382b84
-
SHA256
147592c5eb8e11fc8394125954f877acf25918bae13aa210c2825aefc3030ed8
-
SHA512
ca585221ac4b06ed7b12891b43882e1c219d4656bab0f291a25fb9bd971d09371f1c8e35181a9ae5dafd9a429367ade86ec3f06eb0dc887e8a790c671132cac1
-
SSDEEP
24576:RMl7QhGL9gcpfLXQfrq0FKhpcRXArrbyWgggaaDtktf1aUQJf0C36c1Nh:2FfgPHoim/uhDyl1EfFFF
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4724 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2236 wrote to memory of 4724 2236 java.exe 90 PID 2236 wrote to memory of 4724 2236 java.exe 90
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\libraries\com\ibm\icu\icu4j-core-mojang\51.2\icu4j-core-mojang-51.2.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5e04c86c7ca9fd7cd6e87c55b416af301
SHA1c19739e120380940077561a50b9215ad1f663649
SHA256bb71106cfeb6794498c753bc6770e2e55f70e09345ed72da1db0cf79e75d8e89
SHA5124fab7f4c6992b85ec3bd3c976eef0e40fa3a04485343b2fccb60c5853be6a37466f8e4899e0f1450147a2a343d7573ca1fa5d5a5e980ae8d46b15e7ab920f0ba