7d70b19371306e1600e68018971da0ba6c2debaa923a476193f4431ba4d1153e

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptiCraft JAVA 1.8.9/mcdata/runtime/lib/ext/localedata.jar
Size

2.1MB
MD5

5a5bb580763646b33efe4859a8de0692
SHA1

5fc7a2f8b186f33bbcaf488f28775a416cdda860
SHA256

baac58ac834cdfb904e5071aff7a3594cc4daf92c28cfb2040ffc965581b23c8
SHA512

d8181d9c45533af63eb2e6839a7d78388e6fabdaa097c63082cea3574aa1e3bbdb826eafbbc6ea03807d68efc8e1952157a5efe49dc2623459eb371d2b108826
SSDEEP

24576:NLsj9Uw4eh5iUAUTT6vBCan/BYRuAR2zpinUri0n:psjyw4ejiUAUsBCEZYRuPzpiUriw

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2980	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2980	2456	java.exe	89
PID 2456 wrote to memory of 2980	2456	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\ext\localedata.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
2b1525345b44555d6b856ede4f25498b

SHA1
0556488bc30bbf31382d2a3aa736baf2dd9dbc74

SHA256
3bb4ef493f0fe2ff03c956d43fab49893f448817b630075ec499dd03a08c644c

SHA512
cf7b1e3dd7cb1f39bf34e9b0cf9071864fde128b211ddaef59764ca082c725515b4b0c0bc14e8f0a5cfd14954cb1b73c3d9d8c44f639cfd3ec4aad607d0bafb5

Download Submit
memory/2456-2-0x00000151B9060000-0x00000151B92D0000-memory.dmp

Filesize
2.4MB

Download
memory/2456-11-0x00000151B9040000-0x00000151B9041000-memory.dmp

Filesize
4KB

Download
memory/2456-13-0x00000151B9060000-0x00000151B92D0000-memory.dmp

Filesize
2.4MB

Download