b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/libraries/java/launcher.jar
Size 3.9MB
Sample240408-bgnxpaca9x
SHA256 61ab765fa1f743d34d84e0415144cbff5604ecb7a91370f1ee658f964602afc9
MD5 6e95940ae024d3df5650fb4b41700f98
SHA1 aac608966eb28d03a7293c70d69a43d964d3dab3
SHA512 260b5b6a50ee5df6db1dbfcb38f2dcaf177bd4198271d7eff67b8b6ea178b362d486334a09d82fddee0e41bebb28cba57280a6fe8da615bf57fd0fc3a5fa5e3d
SSDEEP 98304:BC2Ohx/Z31FiSZO9ZmmGaOVsnYalangjF63lOMM+q:zyV98nOVAAa2hM+q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1860	icacls.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4816	java.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1860	4816	java.exe	88
PID 4816 wrote to memory of 1860	4816	java.exe	88
PID 4816 wrote to memory of 2648	4816	java.exe	92
PID 4816 wrote to memory of 2648	4816	java.exe	92
PID 2648 wrote to memory of 1604	2648	cmd.exe	93
PID 2648 wrote to memory of 1604	2648	cmd.exe	93

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\resources\libraries\java\launcher.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Program Files\Java\jre-1.8\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr
    3⤵
    PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 fac184143f85ecc697dce49310341a98e1ca8b2632a7459f75e305fd7c730c2b
MD5 000346df06d0a67a684cd278990fc9a2
SHA1 219e141a7d4447a102050adab56d78313ae31f3a
SHA512 b1adee75918f101deae09e5af8266c9b3c7e33bca3003b1d774bcde6e1a87c82e267c1ac09ede03debeac3da8436a10575c10d7a42867aa2ff36078b9fa4125e
MD5 SHA1 SHA512

Submit Download

memory/1604-21-0x0000022EE0BD0000-0x0000022EE1BD0000-memory.dmp

Download

memory/1604-28-0x0000022EE0BB0000-0x0000022EE0BB1000-memory.dmp

Download

memory/4816-4-0x000001A720F30000-0x000001A721F30000-memory.dmp

Download

memory/4816-19-0x000001A720F10000-0x000001A720F11000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads