7d70b19371306e1600e68018971da0ba6c2debaa923a476193f4431ba4d1153e

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptiCraft JAVA 1.8.9/mcdata/runtime/lib/deploy/messages_fr.jnlp
Size

3KB
MD5

c11ab66fede3042ee75dfd19032c8a72
SHA1

69bd2d03c2064f8679de5b4e430ea61b567c69c5
SHA256

8deeec35ed29348f5755801f42675e3bf3fa7ad4b1e414acca283c4da40e4d77
SHA512

072f8923df111f82f482d65651758b8b4ba2486cb0ea08fb8b113f472a42a1c3bcb00dae7d1780cf371e2c2bd955d8b66658d5ee15e548b1eea16b312fdcbdf9

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2736	icacls.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3116	javaws.exe
3116	javaws.exe
3116	javaws.exe
3116	javaws.exe
1316	javaws.exe
1316	javaws.exe
4384	jp2launcher.exe
4384	jp2launcher.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4384	jp2launcher.exe
4384	jp2launcher.exe
4384	jp2launcher.exe
4384	jp2launcher.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 3116	1304	jp2launcher.exe	88
PID 1304 wrote to memory of 3116	1304	jp2launcher.exe	88
PID 3116 wrote to memory of 1316	3116	javaws.exe	89
PID 3116 wrote to memory of 1316	3116	javaws.exe	89
PID 3116 wrote to memory of 4384	3116	javaws.exe	90
PID 3116 wrote to memory of 4384	3116	javaws.exe	90
PID 4384 wrote to memory of 2736	4384	jp2launcher.exe	91
PID 4384 wrote to memory of 2736	4384	jp2launcher.exe	91

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_fr.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\OptiCraft JAVA 1.8.9\mcdata\runtime\lib\deploy\messages_fr.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    JavaWSSplashScreen -splash 62691 "C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1316
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURqbmxweC5vcmlnRmlsZW5hbWVBcmc9QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfZnIuam5scAAtRGpubHB4LnJlbW92ZT1mYWxzZQAtRHN1bi5hd3Qud2FybXVwPXRydWUALVhib290Y2xhc3NwYXRoL2E6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHBsdWdpbi5qYXIALURqbmxweC5zcGxhc2hwb3J0PTYyNjkyAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGU= -ma QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXE9wdGlDcmFmdCBKQVZBIDEuOC45XG1jZGF0YVxydW50aW1lXGxpYlxkZXBsb3lcbWVzc2FnZXNfZnIuam5scA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "\"everyone\":(OI)(CI)M"
      4⤵
      Modifies file permissions
      PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Filesize
713B

MD5
723f0bd4962f1b4b02452257e4adf632

SHA1
64cf01e9facfdcb08a634d1b8db2720d82c109c1

SHA256
2680a454f84dff8745adfa86d2ea9986acbecf78523b7a6a3e3480c0908456a4

SHA512
1a390702af217ce7feedeff16205613f26a8a9d59ad7ef3f8c2d9f72cc34e47935fd586b82574cc4ee7b787caae936c58cd09c9b54bc8b6bc59b53b1997cffa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar

Filesize
12KB

MD5
4f9f42a2c5524bf0ce187c5dcb517b89

SHA1
b54ff1e485ee0605753e23f254e288f9a79cc59d

SHA256
e271e41f800f3f25e0f9fe212f2e31e6a57b74d28b89fd3425deb42a6a1b411a

SHA512
45eb73dae61b6cb855a33966b6c3f1f064a15714761e3075eda105f72adf3780b05dbfbcca75fb47734ca47bb6abe4a1db075d30b1db748ffca11d9928d6cdbc

Download Submit
memory/4384-112-0x000002175E850000-0x000002175EAC0000-memory.dmp

Filesize
2.4MB

Download
memory/4384-56-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download
memory/4384-70-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download
memory/4384-85-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download
memory/4384-2-0x000002175E850000-0x000002175EAC0000-memory.dmp

Filesize
2.4MB

Download
memory/4384-122-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download
memory/4384-28-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download
memory/4384-154-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download
memory/4384-15-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download
memory/4384-174-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download
memory/4384-201-0x000002175E4C0000-0x000002175E4C1000-memory.dmp

Filesize
4KB

Download