Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:09
Static task
static1
Behavioral task
behavioral1
Sample
SKlauncher-3.2.8.jar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SKlauncher-3.2.8.jar
Resource
win10v2004-20240426-en
General
-
Target
SKlauncher-3.2.8.jar
-
Size
1.1MB
-
MD5
3f6ae53541622bfd30d2d6a850a1c7fc
-
SHA1
fdf2493ebb654889b16e87de32ba353905b3f8a3
-
SHA256
4bc59dacfa6a02b5e825ccb4d545e6749393b30783459637c5075a6c2b60bc68
-
SHA512
810ba9e2caf2fbfb008d6f6414ee8913d8bd83e8f5c66dba5f5eb0291c17abcabffc7655da17152cbb5ef3913df2abb2b918365027aed75ff1a6b610311faa10
-
SSDEEP
24576:k80pSuDlvPepesl6vypvWM1cetaYJXChAX/ChyYOkQ27vLKOBS:PmJ3eI86a9TUYJyhmB87vLZ4
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
java.exepid process 4272 java.exe 4272 java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
java.exepid process 4272 java.exe 4272 java.exe 4272 java.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
java.exedescription pid process target process PID 4272 wrote to memory of 1936 4272 java.exe icacls.exe PID 4272 wrote to memory of 1936 4272 java.exe icacls.exe PID 4272 wrote to memory of 1884 4272 java.exe reg.exe PID 4272 wrote to memory of 1884 4272 java.exe reg.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.8.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:1936 -
C:\Windows\SYSTEM32\reg.exereg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme2⤵PID:1884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD576467bf812f05468e430030b9952b118
SHA1768f74b501f942b00ee2587a18a967eee9f4589c
SHA2568221c228050ab237f8c532388b24355bce6bbf08b782fcac7b08d7e0c4c07933
SHA5121c0f86299d84503ec807511d90ee742fb6ff2f75f11f1d62c9689de2d352fd46045565020aea234919257bb073640307f14a40c13ae1d9481dee04947d582dcd
-
Filesize
405KB
MD58f2869a84ad71f156a17bb66611ebe22
SHA10325b9b3992fa2fdc9c715730a33135696c68a39
SHA2560cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1
SHA5123d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834
-
Filesize
398KB
MD5ff5fdc6f42c720a3ebd7b60f6d605888
SHA1460c18ddf24846e3d8792d440fd9a750503aef1b
SHA2561936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1
SHA512d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3
-
Filesize
397KB
MD5fdb50e0d48cdcf775fa1ac0dc3c33bd4
SHA15c95e5d66572aeca303512ba41a8dde0cea92c80
SHA25664f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123
SHA51220ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53
-
Filesize
23KB
MD58b9f16320499ece60d7ff0c1249c6df7
SHA1cd8fc57c064533df66f0ceaaf5d76f8c4f8cb3a0
SHA256f8a3af19341ac0f12f55ad28169d22b75aa66ed818692541307393c22f986727
SHA51297384ee1faa1be807388f4077fde5db94010f06420b1ff3a05edf77fb91c9a8163b0a91cb1b7e648c0cd8c4d599e552050f64b8f7c5c81c1be60cd35f062e9d3
-
Filesize
248KB
MD5719d6ba1946c25aa61ce82f90d77ffd5
SHA194d2191378cac5719daecc826fc116816284c406
SHA25669c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
SHA512119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
-
Filesize
17.2MB
MD59ca5c6e6b0cf88e6e0bed4afc999a634
SHA1a475f228191f297b8f624bfcabbd9e0872774ab7
SHA256a296683c28d6c1d0fe56526ffd5b37f3f209ab5ee88664bfea56beca61a7f15e
SHA512cb8d09c6652b9b1e3a5c32cf79505ff5fc0aedc2f27f23ffcee615f56d8d83d6b63d173cdb87d5ea99266eac63d310561a426e91259b7038336e4a36b1e4cf1c