7d70b19371306e1600e68018971da0ba6c2debaa923a476193f4431ba4d1153e

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/dnsns.jar
Size

8KB
MD5

4a6e30e29cc5de57e04747023986aeee
SHA1

6f692c80b04cd453992563da2b0926e3a27a1525
SHA256

d67c6127265cb60af0ea7b7698a118ec32a28417caf0878297c488964a5c57f1
SHA512

bbc1b4dbadd049a5b20dc8265cff1a9d475f74d68287be36f196c9161929f342f28cb0dc7fa14409e913abb5f0236856a13af1b1c2a3b138161a77bd8f8c98f7
SSDEEP

192:VN5jIgq7WbMCG+XmHTEIWB7EH+mqcEb+wYtvEmuJyF2:VNZq7WbMwWTFWBAH+BCrEmuP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3784	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3784	3548	java.exe	91
PID 3548 wrote to memory of 3784	3548	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\ext\dnsns.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
2c7df2fb8bb54a734ad152f995764065

SHA1
3b7e39531c418965204b4ccf4d4b731bd1835abc

SHA256
f5545d7f2179a3fb6699ba51532a95ee8ee3a0f0b9c7149e2a2196a4aadb621d

SHA512
098d32f6cd161d0fd4bf168486ab316f489323c886abf68cca61d74ac016cbfdf9583ed4320556dbac798d33bf433f38fdf9c89ab56d0699b7390c4b5a23fda9

Download Submit
memory/3548-2-0x000002025D9E0000-0x000002025DC50000-memory.dmp

Filesize
2.4MB

Download
memory/3548-12-0x000002025D9C0000-0x000002025D9C1000-memory.dmp

Filesize
4KB

Download
memory/3548-13-0x000002025D9E0000-0x000002025DC50000-memory.dmp

Filesize
2.4MB

Download