05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf

General

Target

SKlauncher-3.2.exe
Size

1.6MB
MD5

b63468dd118dfbca5ef7967ba344e0e3
SHA1

2ba4f0df5f3bd284bf2a89aba320e4440d8b8355
SHA256

05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
SHA512

007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548
SSDEEP

49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	SKlauncher-3.2.exe

Loads dropped DLL 2 IoCs

pid	Process
2208	SKlauncher-3.2.exe
2208	SKlauncher-3.2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4732	icacls.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2208	SKlauncher-3.2.exe
2208	SKlauncher-3.2.exe
2208	SKlauncher-3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4700	2208	SKlauncher-3.2.exe	86
PID 2208 wrote to memory of 4700	2208	SKlauncher-3.2.exe	86
PID 4700 wrote to memory of 4732	4700	java.exe	90
PID 4700 wrote to memory of 4732	4700	java.exe	90
PID 2208 wrote to memory of 1608	2208	SKlauncher-3.2.exe	92
PID 2208 wrote to memory of 1608	2208	SKlauncher-3.2.exe	92
PID 2208 wrote to memory of 3536	2208	SKlauncher-3.2.exe	103
PID 2208 wrote to memory of 3536	2208	SKlauncher-3.2.exe	103

C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- \??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
  "c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:4732
- \??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
  "c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:1608
- C:\Windows\SYSTEM32\reg.exe
  reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
  2⤵
  PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
cdae967882ec62638595e0f2ed7a042c

SHA1
daaeec58ba00ef26c5c7f5cf3082daa48cd9ac6a

SHA256
07b2abcb4b67a3bbafb9b0619bfcc5e3a7fadba724d4dd61d93727ccf2750813

SHA512
ab703d11f9d3e0b32ed3c5c48b5232317e64cba99ca4ceec475d7c35440f02e154264c0ace3dbffd5b40fadd419470ceabf4bc8fa151029c1e525fc86bed7fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF1763465297445153710.tmp

Filesize
398KB

MD5
ff5fdc6f42c720a3ebd7b60f6d605888

SHA1
460c18ddf24846e3d8792d440fd9a750503aef1b

SHA256
1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1

SHA512
d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF3380844475647225464.tmp

Filesize
397KB

MD5
fdb50e0d48cdcf775fa1ac0dc3c33bd4

SHA1
5c95e5d66572aeca303512ba41a8dde0cea92c80

SHA256
64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123

SHA512
20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF8895448109161492057.tmp

Filesize
405KB

MD5
8f2869a84ad71f156a17bb66611ebe22

SHA1
0325b9b3992fa2fdc9c715730a33135696c68a39

SHA256
0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1

SHA512
3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834

Download Submit
C:\Users\Admin\AppData\Local\Temp\e4j3E12.tmp_dir1714777595\SKlauncher-3.2.jar

Filesize
1.1MB

MD5
4d653e61ba01a521c56b9a70a9c9814e

SHA1
de855dc3dbc914b497b58da92e0c21fff660796d

SHA256
f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350

SHA512
e6a7db6e2893b5b01dd0c84a230d88abf50da63ceb1af5754a2c4c1fbd307a799a74f3f368430d3beb33590cda2e0a3cf509fef11c4477b76e8d3c4a582b5def

Download Submit
C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4545714195900.dll

Filesize
22KB

MD5
dcd68a87b7e6edbcfde48150403b22eb

SHA1
28e4839a29725075772fccc39b44e194eb91e477

SHA256
ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c

SHA512
ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna2805101057728778106.dll

Filesize
248KB

MD5
719d6ba1946c25aa61ce82f90d77ffd5

SHA1
94d2191378cac5719daecc826fc116816284c406

SHA256
69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44

SHA512
119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar

Filesize
17.2MB

MD5
5b0bfa78154b1c57ab68574af285fc6f

SHA1
bf9f6b357352f81a2e4427c4e5d839b89b32d3b7

SHA256
0e79303169cd0305c364885824b1ee91b15e6ede8b7eae02e808ad4c4c35a36f

SHA512
95dc94b13f82d61e5a168251665412c04710069a1b1679e9674d4a4dd2f824eff994e9ecd92f257a8abe1144239a8a4a6aa492c6b2e71d6faeb4d1e4a3c76d26

Download Submit
memory/1608-20-0x000002B38ADE0000-0x000002B38B050000-memory.dmp

Filesize
2.4MB

Download
memory/1608-30-0x000002B3894F0000-0x000002B3894F1000-memory.dmp

Filesize
4KB

Download
memory/1608-31-0x000002B38ADE0000-0x000002B38B050000-memory.dmp

Filesize
2.4MB

Download
memory/2208-210-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-265-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-139-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-156-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-164-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-82-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-191-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-875-0x0000000002440000-0x00000000026B0000-memory.dmp

Filesize
2.4MB

Download
memory/2208-219-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-227-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-240-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-243-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-247-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-250-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-255-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-256-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-258-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-262-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-264-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-121-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-267-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-49-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-45-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2208-34-0x0000000002440000-0x00000000026B0000-memory.dmp

Filesize
2.4MB

Download
memory/4700-16-0x0000027306420000-0x0000027306690000-memory.dmp

Filesize
2.4MB

Download
memory/4700-15-0x0000027306400000-0x0000027306401000-memory.dmp

Filesize
4KB

Download
memory/4700-5-0x0000027306420000-0x0000027306690000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing