7d70b19371306e1600e68018971da0ba6c2debaa923a476193f4431ba4d1153e

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages.jnlp
Size 2KB
Sample240503-2sg7dsgc5s
SHA256 926ccadaec649f621590d1aa5e915481016564e7ab28390c8d68bdaaf4785f1f
MD5 811bafa6f97801186910e9b1d9927fe2
SHA1 dc52841c708e3c1eb2a044088a43396d1291bb5e
SHA512 5ae9c27dce552ea32603b2c87c1510858f86d9d10cade691b2e54747c3602fe75de032cf8917dcd4ee160ee4cc5be2e708b321bb1d5cdebfa9fe46c2f870ca7c
MD5 SHA1 SHA512

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3140	icacls.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1096	javaws.exe
1096	javaws.exe
1096	javaws.exe
1096	javaws.exe
1824	javaws.exe
1824	javaws.exe
4948	jp2launcher.exe
4948	jp2launcher.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4948	jp2launcher.exe
4948	jp2launcher.exe
4948	jp2launcher.exe
4948	jp2launcher.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1096	3052	jp2launcher.exe	87
PID 3052 wrote to memory of 1096	3052	jp2launcher.exe	87
PID 1096 wrote to memory of 1824	1096	javaws.exe	89
PID 1096 wrote to memory of 1824	1096	javaws.exe	89
PID 1096 wrote to memory of 4948	1096	javaws.exe	90
PID 1096 wrote to memory of 4948	1096	javaws.exe	90
PID 4948 wrote to memory of 3140	4948	jp2launcher.exe	91
PID 4948 wrote to memory of 3140	4948	jp2launcher.exe	91

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    JavaWSSplashScreen -splash 52793 "C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1824
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURqbmxweC5vcmlnRmlsZW5hbWVBcmc9QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXMuam5scAAtRGpubHB4LnJlbW92ZT1mYWxzZQAtRHN1bi5hd3Qud2FybXVwPXRydWUALVhib290Y2xhc3NwYXRoL2E6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHBsdWdpbi5qYXIALURqbmxweC5zcGxhc2hwb3J0PTUyNzk0AC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGU= -ma QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXMuam5scA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "\"everyone\":(OI)(CI)M"
      4⤵
      Modifies file permissions
      PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 713B
SHA256 b54e817bb3aa3104acf3b658c5d7d27ad80ea14ab5ad123ce019c51804a962ac
MD5 bc8b01a267ae0b681d4dd41d57dae6df
SHA1 a29c93a0ecec7fcc9b5557452e04cc03dbea5da2
SHA512 42b0d2e7efba55e24773bfed5a9b2befffa4c9ac58447cd6485f58c8ddd23a9e52eb7c30f62ee4357b759eb4d12ded19fac5dd4fb8a3eaa0266e82ccdf550c43
MD5 SHA1 SHA512

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 e271e41f800f3f25e0f9fe212f2e31e6a57b74d28b89fd3425deb42a6a1b411a
MD5 4f9f42a2c5524bf0ce187c5dcb517b89
SHA1 b54ff1e485ee0605753e23f254e288f9a79cc59d
SHA512 45eb73dae61b6cb855a33966b6c3f1f064a15714761e3075eda105f72adf3780b05dbfbcca75fb47734ca47bb6abe4a1db075d30b1db748ffca11d9928d6cdbc
SSDEEP 192:ThJHBItxePJ6iK/eNMNZtHkufun92DRbiW3vgJVeKtCBoTN3DVja5IKBsOjX/:VJ+twPJ6tW+LEuMauWhKtC2NJ25bBs6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4948-2-0x00000219A20B0000-0x00000219A2320000-memory.dmp

Download

memory/4948-12-0x00000219A1C00000-0x00000219A1C01000-memory.dmp

Download

memory/4948-29-0x00000219A1C00000-0x00000219A1C01000-memory.dmp

Download

memory/4948-52-0x00000219A1C00000-0x00000219A1C01000-memory.dmp

Download

memory/4948-66-0x00000219A1C00000-0x00000219A1C01000-memory.dmp

Download

memory/4948-79-0x00000219A1C00000-0x00000219A1C01000-memory.dmp

Download

memory/4948-105-0x00000219A20B0000-0x00000219A2320000-memory.dmp

Download

memory/4948-143-0x00000219A1C00000-0x00000219A1C01000-memory.dmp

Download

memory/4948-166-0x00000219A1C00000-0x00000219A1C01000-memory.dmp

Download

memory/4948-176-0x00000219A1C00000-0x00000219A1C01000-memory.dmp

Download