2d840a08d60d89aa2a0b07cec1e4c940e5d6b59bddbea43465f46086508caf51

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mods/meteor-rejects-addon-0.2.jar
Size

1.3MB
MD5

c71dc4f7c93249a834c0567312fa6e5d
SHA1

6698431b59451631b96a1a830803ed010f551a26
SHA256

1d2698ec80da023547dea65172b6360193884da391cb3182beb19c6123ec86fa
SHA512

e6b307edb1fd7ed62cbb90ac5e1be38752b519fb628bafd31485f106e681ce8f9fb68e1e0719735ebfff16e2e257f8a8da01b1696991918b106d549904ac00b1
SSDEEP

24576:SlJ2zI38Y9k07b8RVf3Qw1d2MDvKcEcpTRbvWozSCRUyBUJbxL:IJ2zI384k0v8rQwzZpVOkSCRgt

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3068	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3068	5020	java.exe	91
PID 5020 wrote to memory of 3068	5020	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\mods\meteor-rejects-addon-0.2.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
50f07f0936cdc2c122b6f31c14e88c26

SHA1
f73872d338937c4a154ab645a8a4e77f4bd9808e

SHA256
03f6dd14e84e3a91d0db725517eda4d78227b2ea39df2462dd70d2cd0c23234c

SHA512
3945b26760efb367e7b33954a8c3d612320b074d71ceae4b5f4a1a79d222dd8402a1c6ccef8212e28557c532b4e031bc0580f14bcfbf941868c2c07af9a805c7

Download Submit
memory/5020-4-0x0000019A10130000-0x0000019A11130000-memory.dmp

Filesize
16.0MB

Download
memory/5020-12-0x0000019A10110000-0x0000019A10111000-memory.dmp

Filesize
4KB

Download