7d70b19371306e1600e68018971da0ba6c2debaa923a476193f4431ba4d1153e

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_de.jnlp
Size

3KB
MD5

d77c3b5274b8161328ab5c78f66dd0d0
SHA1

d989fe1b8f7904888d5102294ebefd28d932ecdb
SHA256

c9399a33bb9c75345130b99d1d7ce886d9148f1936543587848c47b8540da640
SHA512

696e28b6bc7e834c51ab9821d0d65d1a32f00eb15caa732047b751288ea73d8d703d3152bf81f267147f8c1538e1bf470748df41176392f10e622f4c7708dd92

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3080	icacls.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3500	javaws.exe
3500	javaws.exe
3500	javaws.exe
3500	javaws.exe
4696	javaws.exe
4696	javaws.exe
3568	jp2launcher.exe
3568	jp2launcher.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3568	jp2launcher.exe
3568	jp2launcher.exe
3568	jp2launcher.exe
3568	jp2launcher.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 3500	564	jp2launcher.exe	88
PID 564 wrote to memory of 3500	564	jp2launcher.exe	88
PID 3500 wrote to memory of 4696	3500	javaws.exe	89
PID 3500 wrote to memory of 4696	3500	javaws.exe	89
PID 3500 wrote to memory of 3568	3500	javaws.exe	90
PID 3500 wrote to memory of 3568	3500	javaws.exe	90
PID 3568 wrote to memory of 3080	3568	jp2launcher.exe	91
PID 3568 wrote to memory of 3080	3568	jp2launcher.exe	91

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_de.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_de.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    JavaWSSplashScreen -splash 61774 "C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4696
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURqbmxweC5vcmlnRmlsZW5hbWVBcmc9QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfZGUuam5scAAtRGpubHB4LnJlbW92ZT1mYWxzZQAtRHN1bi5hd3Qud2FybXVwPXRydWUALVhib290Y2xhc3NwYXRoL2E6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHBsdWdpbi5qYXIALURqbmxweC5zcGxhc2hwb3J0PTYxNzc1AC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGU= -ma QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfZGUuam5scA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "\"everyone\":(OI)(CI)M"
      4⤵
      Modifies file permissions
      PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Filesize
713B

MD5
ac21bcdf96ef92e38e11225c33992c67

SHA1
05f8be7a8034203f209f5cafb3bdf1bdc26171b7

SHA256
499ebc6a4b444eff4c292815b664dfe79b035adcb05572ae2c67d13a179f646c

SHA512
c642728c34ad78f5a3b7782d6e1110708e85f339858e51fce17f1fcc7c5750ad8c77fcc25c7c01453318586c7753c3eb96a940c5a4d4363825670a04c5c0c0aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar

Filesize
12KB

MD5
4f9f42a2c5524bf0ce187c5dcb517b89

SHA1
b54ff1e485ee0605753e23f254e288f9a79cc59d

SHA256
e271e41f800f3f25e0f9fe212f2e31e6a57b74d28b89fd3425deb42a6a1b411a

SHA512
45eb73dae61b6cb855a33966b6c3f1f064a15714761e3075eda105f72adf3780b05dbfbcca75fb47734ca47bb6abe4a1db075d30b1db748ffca11d9928d6cdbc

Download Submit
memory/3568-116-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download
memory/3568-65-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download
memory/3568-78-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download
memory/3568-107-0x0000028B00000000-0x0000028B00270000-memory.dmp

Filesize
2.4MB

Download
memory/3568-2-0x0000028B00000000-0x0000028B00270000-memory.dmp

Filesize
2.4MB

Download
memory/3568-117-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download
memory/3568-28-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download
memory/3568-148-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download
memory/3568-15-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download
memory/3568-168-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download
memory/3568-173-0x0000028B77320000-0x0000028B77321000-memory.dmp

Filesize
4KB

Download