7d70b19371306e1600e68018971da0ba6c2debaa923a476193f4431ba4d1153e

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/access-bridge-32.jar
Size

183KB
MD5

c6a49400ac00b34e5819436e2237bb94
SHA1

bbe6fc016d4e5b89fecbd15f5916d71af8811645
SHA256

3b508ac5c57729b5650ec3baf2a561d9443c1f20a29790107e4cb99fe69be21d
SHA512

032d7e720c34127b5aeee1dd0ad8713bf27d0ae4eb9ee106fdec1962fdf2f5467d948a277d8074420ca39f83c9f4f6698cde39f2cbc1a80a7f0f5831eabfe38e
SSDEEP

3072:ZYtuC+MUaSN/rUcZWibP64ueCKslj6HX5202UA1d7j/oZu8oagepYwQmq:vDaarUcZWMbuvE3k02xIRoveiwQp

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4280	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4280	4516	java.exe	88
PID 4516 wrote to memory of 4280	4516	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\ext\access-bridge-32.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
a1b1f0ed138538ff16a7f1fcf3b738ef

SHA1
41cdd65db4b5e35bd0e9a014b30a0830295b35de

SHA256
80bd89499fc84478bf901c2bb556a64b95050785df757a05abe890c95063e4a0

SHA512
2a43118ff4bc1c39d5185f3442078fd62f72bed78e6d1c578ad47e7ca4c25be553c77fa3acdfeba16950865e0f87e6768410b949bcd9f65a7122cc84d57b92ea

Download Submit
memory/4516-2-0x000001FE36E40000-0x000001FE370B0000-memory.dmp

Filesize
2.4MB

Download
memory/4516-11-0x000001FE35600000-0x000001FE35601000-memory.dmp

Filesize
4KB

Download
memory/4516-13-0x000001FE36E40000-0x000001FE370B0000-memory.dmp

Filesize
2.4MB

Download