Overview
overview
7Static
static
3libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/....2.jar
windows7-x64
1libraries/....2.jar
windows10-2004-x64
7libraries/...21.jar
windows7-x64
1libraries/...21.jar
windows10-2004-x64
7libraries/....8.jar
windows7-x64
1libraries/....8.jar
windows10-2004-x64
7libraries/...59.jar
windows7-x64
1libraries/...59.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...23.jar
windows7-x64
1libraries/...23.jar
windows10-2004-x64
7libraries/...24.jar
windows7-x64
1libraries/...24.jar
windows10-2004-x64
7libraries/...07.jar
windows7-x64
1libraries/...07.jar
windows10-2004-x64
7libraries/....9.jar
windows7-x64
1libraries/....9.jar
windows10-2004-x64
7libraries/....4.jar
windows7-x64
1libraries/....4.jar
windows10-2004-x64
7libraries/....3.jar
windows7-x64
1libraries/....3.jar
windows10-2004-x64
7libraries/....0.jar
windows7-x64
1libraries/....0.jar
windows10-2004-x64
7libraries/...al.jar
windows7-x64
1libraries/...al.jar
windows10-2004-x64
7Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
libraries/com/google/guava/guava/17.0/guava-17.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
libraries/com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
libraries/com/mojang/netty/1.8.8/netty-1.8.8.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
libraries/com/mojang/realms/1.7.59/realms-1.7.59.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
libraries/com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
libraries/com/paulscode/codecwav/20101023/codecwav-20101023.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral17
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
libraries/com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral19
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
libraries/com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral21
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
libraries/com/paulscode/soundsystem/20120107/soundsystem-20120107.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral23
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral25
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
libraries/commons-io/commons-io/2.4/commons-io-2.4.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral27
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
libraries/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral29
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
libraries/io/github/battlyclient/wrapper/2.0.0/wrapper-2.0.0.jar
Resource
win10v2004-20240221-en
Behavioral task
behavioral31
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
libraries/io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar
Resource
win10v2004-20240221-en
General
-
Target
libraries/com/mojang/authlib/1.5.21/authlib-1.5.21.jar
-
Size
62KB
-
MD5
70565f6a4aa38a8e8541ef019adbf8ad
-
SHA1
aefba0d5b53fbcb70860bc8046ab95d5854c07a5
-
SHA256
ce7a9c86ebebf30b89929026f4a0a3c58ce0f4d47937d6dc086ae4fd0c77544a
-
SHA512
7223d0e9a0c8bae870c88748008062ee1e9c659e8b1acf200ece0ab71488bd6c4447db779ae61258d07a0dbc6f46f03ad1f168d2a2cac0f758f9729b38d92731
-
SSDEEP
1536:wLxCY5177oygmsyF9V6iIHStF3qXG3bhOY3NPItTacEFWD2z:wLxN5178yFlqX4bhOm+tTK
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1096 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1096 1836 java.exe 88 PID 1836 wrote to memory of 1096 1836 java.exe 88
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\libraries\com\mojang\authlib\1.5.21\authlib-1.5.21.jar1⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:1096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD59ce141c29a374da9f0ba1be1f00ce8ac
SHA14671c21887088adb2e84aa50173deb2f79d2f7cd
SHA25661d0809b1481c42dbd8659f072f5c5041c85ea7fad72da834c1dfd914d185e94
SHA512f6226f605340acca3e9baf2b4c191083ca138946df0ced061d5747d060dc369b3ff4696d559447cc7f7848f250d28588b6bc9e6eb24f5d54c21de9754bf380ad