1293a729057dedb90d5271621afbcd14b38be19b2a31570a330e2ebcb3eb1bb3

General

Target

SKlauncher-3.jar
Size

1.1MB
MD5

7454d24ae19035309ab3eea108fbb777
SHA1

ce3dbbc97a10cb7d08d4d8af4a245f148efd5b11
SHA256

1293a729057dedb90d5271621afbcd14b38be19b2a31570a330e2ebcb3eb1bb3
SHA512

1c1ae4941372312739ca53b1473288a699f7161ff48936d9b602eae21bd98474112dca548f2e4f6b4db40a2680caded4560f9fe86c655691e8f096c1d705ec3b
SSDEEP

24576:udAL7aa7IXWJ4FCDzQvrmqBqAXxKhd1ODQZ3z0Ix8GbjOaHmeBi:mgFzIvrWphdcDQZ3jx8GnVGeBi

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
412	java.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3852	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
412	java.exe
412	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3852	412	java.exe	91
PID 412 wrote to memory of 3852	412	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.jar
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4216 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-5093809800000.dll

Filesize
22KB

MD5
dcd68a87b7e6edbcfde48150403b22eb

SHA1
28e4839a29725075772fccc39b44e194eb91e477

SHA256
ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c

SHA512
ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71

Download Submit
memory/412-117-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-127-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-11-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-27-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-29-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-31-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-33-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-52-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-122-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-56-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-57-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-70-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-92-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-108-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-17-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-112-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-51-0x000002B265730000-0x000002B265731000-memory.dmp

Filesize
4KB

Download
memory/412-2-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-131-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-135-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-138-0x000002B2673A0000-0x000002B2673B0000-memory.dmp

Filesize
64KB

Download
memory/412-139-0x000002B2672D0000-0x000002B2672E0000-memory.dmp

Filesize
64KB

Download
memory/412-140-0x000002B2672E0000-0x000002B2672F0000-memory.dmp

Filesize
64KB

Download
memory/412-141-0x000002B2672F0000-0x000002B267300000-memory.dmp

Filesize
64KB

Download
memory/412-142-0x000002B267310000-0x000002B267320000-memory.dmp

Filesize
64KB

Download
memory/412-143-0x000002B267320000-0x000002B267330000-memory.dmp

Filesize
64KB

Download
memory/412-144-0x000002B267370000-0x000002B267380000-memory.dmp

Filesize
64KB

Download
memory/412-145-0x000002B267380000-0x000002B267390000-memory.dmp

Filesize
64KB

Download
memory/412-146-0x000002B267390000-0x000002B2673A0000-memory.dmp

Filesize
64KB

Download
memory/412-147-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download
memory/412-148-0x000002B2673B0000-0x000002B2673C0000-memory.dmp

Filesize
64KB

Download
memory/412-149-0x000002B266F80000-0x000002B267F80000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing