007370ef1802f2d3466f84a38829747402ce9b4c60e2a6ecd0afb315b04e5b10

Analysis

max time kernel
1481s
max time network
1507s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14-03-2024 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mods/entityculling-fabric-1.6.2-mc1.20.jar
Size

56KB
MD5

7762e45df7b56fb6c10338e2ec07ee09
SHA1

cf43e7a58fb62f75d664cce1b14a6064774e6547
SHA256

53c120668de1d48e5cae23670ddd8e3282c7579d11d8e18d9d8d32000f31aa94
SHA512

d041998579b5b814c2e1c8deab3aa3cb76132c9130fd5abdbedbe4fda8d503cb333922ab5f33c40b2649c6e0504cd9f65c44246c6e346b8e9cfd8f7895fd7334
SSDEEP

768:YV0oOVYzpYYKvqbSv89P9yP7txod3TV9hPO3TAbMfP3pxtOFjdAF0o0G8k4oR1sx:YOVhX8aPKXJGbs+0v0wfaNIn

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3392	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3392	3012	java.exe	82
PID 3012 wrote to memory of 3392	3012	java.exe	82

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\mods\entityculling-fabric-1.6.2-mc1.20.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
fbf0b0337fa7fd06c8105facfb9500ed

SHA1
682a2c55360ca8045f85efa9c191c2c6a078a190

SHA256
d955ba48d1d772a871c04bb48a00752f2072542ddc7e70de8e6bddc20cc4d3a7

SHA512
ad238282880dbeed66117ce33d7c5b657c671aefbf531dc7cea7c4c04f15e9d916b8920801aa19692fc77a2ce89cc6be9bba6388d868af116291ada1e5f0c10b

Download Submit
memory/3012-4-0x000001DF00000000-0x000001DF01000000-memory.dmp

Filesize
16.0MB

Download
memory/3012-10-0x000001DF751B0000-0x000001DF751B1000-memory.dmp

Filesize
4KB

Download
memory/3012-13-0x000001DF00000000-0x000001DF01000000-memory.dmp

Filesize
16.0MB

Download