cf4842b2b009a13f776138058989511941412f5c6316ea5e9dcdc91e8e29fcc3

Analysis

max time kernel
267s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XeroCheatClient.jar
Size 2.6MB
Sample240420-ssamwabd99
SHA256 cf4842b2b009a13f776138058989511941412f5c6316ea5e9dcdc91e8e29fcc3
MD5 8e50566d13d44fb4e9288d78579cbc96
SHA1 8b769d569e40089874dba5c8f3171de21d6abe30
SHA512 2a64346f83d5fd2c43b0883d75f4cc4a596a692858a8ce538a38cc6f9707f80977488f1c5ffdf5a61c50ac991c7a66d43d80a0fcd376f8da4b7ef0e9de4f26eb
SSDEEP 49152:aFQZlIt+AV3ASubuLh0n7SgiXJokr28iXOKzByKd/db689LVnwqlDEVMMqTdqm2:aWZNAVvMuLh0WnoTe0yYo89RnwhL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4888	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5068	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4888	5068	java.exe	85
PID 5068 wrote to memory of 4888	5068	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\XeroCheatClient.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 84d211d216a16d138c76de0abc6da2431b649382b31590f6c44b71824364466b
MD5 a9cd04f8f46df25d54d3ea2cffe93fd2
SHA1 6d166b5c0466ad675f8e63335f80fd65a0fc16e3
SHA512 92efc607f62f91191e267cde10ebdd8899000bdd148ba8cbbb37074fe72f6489d0a8c044fa431f00e01bf151fc61868be48e24229a173fd80a6e5ba6126cf563
MD5 SHA1 SHA512

Submit Download

memory/5068-4-0x000002CB0B7B0000-0x000002CB0C7B0000-memory.dmp

Download

memory/5068-15-0x000002CB0B790000-0x000002CB0B791000-memory.dmp

Download

memory/5068-20-0x000002CB0B7B0000-0x000002CB0C7B0000-memory.dmp

Download

memory/5068-26-0x000002CB0BA30000-0x000002CB0BA40000-memory.dmp

Download

memory/5068-27-0x000002CB0BA40000-0x000002CB0BA50000-memory.dmp

Download

memory/5068-28-0x000002CB0BA60000-0x000002CB0BA70000-memory.dmp

Download

memory/5068-29-0x000002CB0BA70000-0x000002CB0BA80000-memory.dmp

Download

memory/5068-30-0x000002CB0B7B0000-0x000002CB0C7B0000-memory.dmp

Download

memory/5068-31-0x000002CB0BA80000-0x000002CB0BA90000-memory.dmp

Download

memory/5068-32-0x000002CB0B7B0000-0x000002CB0C7B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads