7d70b19371306e1600e68018971da0ba6c2debaa923a476193f4431ba4d1153e

Analysis

max time kernel
129s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/jaccess.jar
Size

43KB
MD5

4ca30bfdc85a770d989ad75297f30c7e
SHA1

6f8d26bdeeae388f1d1a1a580ca999a09fd01267
SHA256

48d92bf30908cab3add4fc2c523d36919224f08b62b55ea405edd6470416a48b
SHA512

c0db14632ec75ea0ecfe9df2b495217be8a88461dc6bd9236a5d34b4d6cd134ef1cdcd6bd2f144f70e6202cef45bc5060d6cbdea3db19c97acc0a65538258b4f
SSDEEP

768:vGT1OFd0LT44CeVav+htHI8ocQBI0gq//a5MWGkOEg3hfRzOG:vGTIF044umhttJNH3lJOEgPOG

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4024	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4024	4652	java.exe	89
PID 4652 wrote to memory of 4024	4652	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\ext\jaccess.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
ec23643250bf8d685a2bb2a301372e4b

SHA1
50ed4986bcdd0fdf0f958c8ee64c3271590685d4

SHA256
0547d5c68c90ef57026d7113a7efc4ac883b12902adee2e3f8bed8811f16fa0a

SHA512
7572c7a38ebebbc9b23690436e6ef6edb43e9a4907d22a4225feef5359693b7bca2b3793fe52a1e5fe9f569c1319c9ce63505071e9f95782e4ac11032880d6e7

Download Submit
memory/4652-2-0x0000027F503B0000-0x0000027F50620000-memory.dmp

Filesize
2.4MB

Download
memory/4652-12-0x0000027F4EB10000-0x0000027F4EB11000-memory.dmp

Filesize
4KB

Download
memory/4652-13-0x0000027F503B0000-0x0000027F50620000-memory.dmp

Filesize
2.4MB

Download