7d70b19371306e1600e68018971da0ba6c2debaa923a476193f4431ba4d1153e

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_pt_BR.jnlp
Size

3KB
MD5

9bb1253a3f79152ea273cf6a52a18080
SHA1

c1084130f767d3955dac9c89c2cc67c59a9bbb8c
SHA256

40aeb9eb0ab79be2d25764cbc16e5388a3be12ebaf10e96837feeecf44354948
SHA512

6396cbbe7672a7a2e7c3b7b64c150a13356c8eddac84b764789c1c421942f1bc5a166d635ce1dc122050bb8a9985bfda96b25c2adf52409af981bd89fc4db5c9

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2436	icacls.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4592	javaws.exe
4592	javaws.exe
4592	javaws.exe
4592	javaws.exe
916	javaws.exe
916	javaws.exe
1684	jp2launcher.exe
1684	jp2launcher.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1684	jp2launcher.exe
1684	jp2launcher.exe
1684	jp2launcher.exe
1684	jp2launcher.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4592	1468	jp2launcher.exe	87
PID 1468 wrote to memory of 4592	1468	jp2launcher.exe	87
PID 4592 wrote to memory of 916	4592	javaws.exe	88
PID 4592 wrote to memory of 916	4592	javaws.exe	88
PID 4592 wrote to memory of 1684	4592	javaws.exe	89
PID 4592 wrote to memory of 1684	4592	javaws.exe	89
PID 1684 wrote to memory of 2436	1684	jp2launcher.exe	90
PID 1684 wrote to memory of 2436	1684	jp2launcher.exe	90

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_pt_BR.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_pt_BR.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    JavaWSSplashScreen -splash 55997 "C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:916
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURqbmxweC5vcmlnRmlsZW5hbWVBcmc9QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfcHRfQlIuam5scAAtRGpubHB4LnJlbW92ZT1mYWxzZQAtRHN1bi5hd3Qud2FybXVwPXRydWUALVhib290Y2xhc3NwYXRoL2E6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHBsdWdpbi5qYXIALURqbmxweC5zcGxhc2hwb3J0PTU1OTk4AC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGU= -ma QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfcHRfQlIuam5scA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "\"everyone\":(OI)(CI)M"
      4⤵
      Modifies file permissions
      PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Filesize
713B

MD5
755e0319157b6dc45de3923159392f54

SHA1
5968586fc79b61d8dcde68232344e4e82a420ddf

SHA256
b4ba54773da75205baf5e93a4f0fb66e2023156b37773262b97f5a5224cc8581

SHA512
35861854dbe5b37d033d35a1aa7e5501ce11713cf7aabe707d0b40a7ecf887a265e2bbd682a3e04dc8b26499b592c02ec935dfe7339265c8d0d149c4d740e4a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar

Filesize
12KB

MD5
4f9f42a2c5524bf0ce187c5dcb517b89

SHA1
b54ff1e485ee0605753e23f254e288f9a79cc59d

SHA256
e271e41f800f3f25e0f9fe212f2e31e6a57b74d28b89fd3425deb42a6a1b411a

SHA512
45eb73dae61b6cb855a33966b6c3f1f064a15714761e3075eda105f72adf3780b05dbfbcca75fb47734ca47bb6abe4a1db075d30b1db748ffca11d9928d6cdbc

Download Submit
memory/1684-81-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-44-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-55-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-69-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-2-0x0000027E51780000-0x0000027E519F0000-memory.dmp

Filesize
2.4MB

Download
memory/1684-111-0x0000027E51780000-0x0000027E519F0000-memory.dmp

Filesize
2.4MB

Download
memory/1684-28-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-143-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-152-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-15-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-172-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download
memory/1684-177-0x0000027E51360000-0x0000027E51361000-memory.dmp

Filesize
4KB

Download