007370ef1802f2d3466f84a38829747402ce9b4c60e2a6ecd0afb315b04e5b10

Analysis

max time kernel
1378s
max time network
1148s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14-03-2024 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mods/replayvoicechat-1.20.1-1.3.1.jar
Size

208KB
MD5

3dc6c71a6bca436e87a2d25e99e679fe
SHA1

55b9997221152a0b7fc7213ae4068707d314e3a8
SHA256

583474a819d48b21f6e7062cc0cf43b2390076fd75c6d5f7045f1d42b4b807ad
SHA512

8d7ceb260e41336e40119b9cc7739f03ee82b3e168bc3d4444c3f20f941784496a7a84309c3ff8cf66cc4d4509b6af4373e5039d6c39f87ca7329c3c80070d6f
SSDEEP

3072:OY2cMeqjuFKBY4Hc1ZdhFLe4TQXjA5pI0Kh3ctKE6TTyAzRo+VwO7xY64+:OYuwO+ZlcjP/h3yfWP7b+Q

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1924	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1924	2836	java.exe	81
PID 2836 wrote to memory of 1924	2836	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\mods\replayvoicechat-1.20.1-1.3.1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
b97b78b5cd5348230ff73e8738c48809

SHA1
f7802a3941a71bcbd11e75cbf11282a1a911ec26

SHA256
c57bbd2f6cddc21bee2bcd3852527d0b4e95a6504201c045c15f98810f768296

SHA512
22aec9c970f8c75ec39ffa81bb01aa356579a1f4c89bee73f53649937ef16f734ef9e94d4a1d26aea08535b29e3114f440fc7380d16afdc7cc6496e0a82f17aa

Download Submit
memory/2836-3-0x0000021687590000-0x0000021688590000-memory.dmp

Filesize
16.0MB

Download
memory/2836-12-0x0000021687570000-0x0000021687571000-memory.dmp

Filesize
4KB

Download