Analysis
-
max time kernel
90s -
max time network
202s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/05/2024, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.jar
Resource
win11-20240508-en
General
-
Target
Launcher.jar
-
Size
5.1MB
-
MD5
2c60123a0b4cb64f4d0831746ff2353d
-
SHA1
5d0e57a8bfcc802f32bb1c5012fb3d89364d779d
-
SHA256
bb183b5d25328df21c958beba4a921d9300e7808d54d0ac801e49549fc60d4e0
-
SHA512
204c042f59e0d86223ee2713d0538114038ec4529291377f0c927d722de595bd38388acf229a9fed9d8a4abc2c51752903e18f38ceab024a4949bac834764236
-
SSDEEP
98304:g9m1QLa/qcCyPH2DwtnbACoOJ5NG7q6QK2Qcls5vtKuwAYpn1vtqdJbm/5Wuhn0I:g9Lxacwtnbp/5NAq6QKelslZqlttVh0I
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2276 icacls.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4980 java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4980 wrote to memory of 2276 4980 java.exe 82 PID 4980 wrote to memory of 2276 4980 java.exe 82
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Launcher.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5980ba1c1254455df08fc81f5b11ba212
SHA1b6b1c5d1a45f3cf89d1ef60e1052eeb4e4c1f0fa
SHA256253232a6508f55d773a30b3fb9205f7634cc134eae3a62ba2e31db989cc3fd98
SHA512dc1916d896a957d1ab100d8075ca911e3c05821b20293b11ba370136a64c4e7793776d8846992c0c30e41201134b7ac4532387f23e91de2177fc9e0f3cf8a9fb
-
Filesize
3B
MD5a0b6c3e24f6f2433b030951bc488f759
SHA11d383314988e188c925a9b47065e1285e25551e3
SHA2569b6dd0f55d1cea37555db317f53a0631f694bd46df8018cc2aeed3d9e2f32f5f
SHA51216e024531f95614599758cb3996e5a9303af312912c7eade0b27bd46979a6c0704e8d63d09bbbc81f94a3d762f8a256005dca4a6c531bcd262a8583e7ee7a74f
-
Filesize
3B
MD5c83bbf39a26190b2d0ec2d3091356053
SHA12c29ec19a8ec05d0caa6527ea271229c0e7a7442
SHA2567c468f5e59f2871b946e051445493bbcace531d597edbbcc9935e7d02d025114
SHA512076c9ebfdd34c47081d70ea7a493b1cf324b3b5ae8286886590167f865d0d2936c8fe31b8c1e4bf7c40425c58f146c4d7b8e49b2eff991efb830a0518e041b7f