aa30084b9cdead50633102494057a2c25dfafd8cce58c212a2484582674dd6a5

Analysis

max time kernel
108s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

meteor-client-0.5.6-2041.jar
Size

4.3MB
MD5

0b43e0fd90fda4ddbf165fccc7a33dc4
SHA1

4f6fe6628ab8781540b7d27034842760338f357e
SHA256

aa30084b9cdead50633102494057a2c25dfafd8cce58c212a2484582674dd6a5
SHA512

de2fbd3737658e5be24459c1781200dc409b859ea9672411b605a9c2455dedde158ecb2a1fdea21a3e246d0c3b6b018d63b55b9954bc3bd80fbacba4a1836926
SSDEEP

98304:RM2SKrU1TdVTWClwcXBNXsgk6FQYBjs0KGgeVKhDWKxESg:RM2u5ZWClwaNtQYBjYuzKxW

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
964	icacls.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4608	java.exe
4608	java.exe
4608	java.exe
4608	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 964	4608	java.exe	88
PID 4608 wrote to memory of 964	4608	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\meteor-client-0.5.6-2041.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f85f19b0b9e592417fe5d202243c54e9

SHA1
4cbb8673d6057484b67956fadd035ab45025c53e

SHA256
bb8fb994de9304893daba45f90f1f5a03dd0d3f6911a265fff9dd0c4b1d85c40

SHA512
cc161380e772173b55c7df6502cd560e8b9cc7698e1155f1f4fb9ad09ff8a51dd3420e42b0ec75b8415c372f8e20f17f009e14f4ec4f2c2159f32670f15f22d1

Download Submit
memory/4608-33-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-18-0x000002B97D9C0000-0x000002B97D9C1000-memory.dmp

Filesize
4KB

Download
memory/4608-25-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-30-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-32-0x000002B97D9C0000-0x000002B97D9C1000-memory.dmp

Filesize
4KB

Download
memory/4608-4-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-35-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-37-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-46-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-49-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-55-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download
memory/4608-57-0x000002B900000000-0x000002B901000000-memory.dmp

Filesize
16.0MB

Download