36219222dfc43c42a9edef1da9ed53442ae08c617c3e4a217de61d0b15910f45

Analysis

max time kernel
42s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SkyblockAddons-1.7.2-for-MC-1.8.9.jar
Size 3.9MB
Sample240223-lt6clsed6s
SHA256 36219222dfc43c42a9edef1da9ed53442ae08c617c3e4a217de61d0b15910f45
MD5 4e2d828d8f1e34444dc5d6523442e583
SHA1 6ae0f2801a5ed6306718c0f9f80ebba422fad91d
SHA512 df06af5955b2c37af039c5e210d8103f5bd2551671777957bcbf82f4369b656f2c7277f0b99dee9567e330fd4f673e04306053f2afc91015fccd7512dea4d558
SSDEEP 98304:XwpzwLSSXprMBTfZAt6IjDrRPzJdr4c2Rhoq:XUDSZmKlXRPFKc2RL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4404	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3228	java.exe
3228	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4404	3228	java.exe	86
PID 3228 wrote to memory of 4404	3228	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\SkyblockAddons-1.7.2-for-MC-1.8.9.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 f399fa7eb645fa74e57405ec7cf5580ed8be6188faadbb25b5256a3cccb6b550
MD5 75bda1ff85407325e956aa848d21c2f1
SHA1 50b5671fdb4a23a603a858fc8494511748cace03
SHA512 208ed7a44ff2fc79ae2fbce2bd3c6ee406cbb72e07d7b6918166ac2427f59b19f6a53ee783d32f92b16337f7544692ad1fffc0bc995f879e76e0e1db121d8489
MD5 SHA1 SHA512

Submit Download

memory/3228-4-0x000001EB35200000-0x000001EB36200000-memory.dmp

Download

memory/3228-17-0x000001EB33940000-0x000001EB33941000-memory.dmp

Download

memory/3228-28-0x000001EB33940000-0x000001EB33941000-memory.dmp

Download

memory/3228-30-0x000001EB35200000-0x000001EB36200000-memory.dmp

Download

memory/3228-33-0x000001EB35200000-0x000001EB36200000-memory.dmp

Download

memory/3228-35-0x000001EB33940000-0x000001EB33941000-memory.dmp

Download

memory/3228-37-0x000001EB35200000-0x000001EB36200000-memory.dmp

Download

memory/3228-41-0x000001EB35200000-0x000001EB36200000-memory.dmp

Download

memory/3228-44-0x000001EB35200000-0x000001EB36200000-memory.dmp

Download

memory/3228-50-0x000001EB33940000-0x000001EB33941000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads