2d840a08d60d89aa2a0b07cec1e4c940e5d6b59bddbea43465f46086508caf51

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mods/fabric-api-0.53.0+1.18.2.jar
Size

1.3MB
MD5

e5f6a9325951bad339cfd4bb3d17e791
SHA1

9763a1588fe73c36a4d15f98d974240ec7e5ad6b
SHA256

3e42a893a0145d1510b11a3c27aadd5f90d292bb0240dbae03d6de0ba2e9d81b
SHA512

9496c5ed97d2fb6b70e14004186702b5e678209090182c1ebe1a0f452204bfb7a8306ddbf141988701901bfa3cfa4998ebeb50d8502e7337487505d282f80be0
SSDEEP

24576:y0VD/ceWDM+JukjT6f5mqzKdIuEbqtfk7sWZNymqXmyr6Da03d:p2Df4kjT63zGIuDWZmXRGDa03d

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3296	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3296	1548	java.exe	91
PID 1548 wrote to memory of 3296	1548	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\mods\fabric-api-0.53.0+1.18.2.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6dee7529f21fa10fc3a63b531a61fc8d

SHA1
4462736eb628b20972685ae0d39aa2f22cec177f

SHA256
fd26eabdec92d18e8ee5c93bdc4b5dd84a2a41a6393b603807c4ac14427f3017

SHA512
79e7f1426efadacde4fce8784cee7fb0ecffe54ede193e2a559248d5585e33bac62cd422b88e70424141ef38cd9750e49bda61d5ece11776e54fe0d20ac76e3f

Download Submit
memory/1548-2-0x000002DF98230000-0x000002DF99230000-memory.dmp

Filesize
16.0MB

Download
memory/1548-11-0x000002DF96960000-0x000002DF96961000-memory.dmp

Filesize
4KB

Download