5d12fb93a3f9c48e0863da39809270af03aac542b74f0145aa3fc4e033b36ddf

Analysis

max time kernel
91s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MultiMC/jars/JavaCheck.jar
Size

1KB
MD5

a0b69fde80253c8fe9616ead35b6236c
SHA1

cbcb8fcdecbf509f80210ddaed6738ac94ba183f
SHA256

b8a91afe70d3c6aabbba075a0bed9f8f7f2b28ffb2e0b96552b761828e5ed451
SHA512

22fd17c66576fb02bf0b6aea24de2b2d3b6678a6d6d57ce0b47a0df4b2c3c2553d221b01c90f0ba9a9a1e9aa2948a22defb0baa394d69863be4cafe1455b83cf

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3592 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1840 wrote to memory of 3592 1840 java.exe icacls.exe
PID 1840 wrote to memory of 3592 1840 java.exe icacls.exe

pid	process
3592	icacls.exe

description	pid	process	target process
PID 1840 wrote to memory of 3592	1840	java.exe	icacls.exe
PID 1840 wrote to memory of 3592	1840	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\MultiMC\jars\JavaCheck.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
ef5026b9622aacf63f4935105d8de37c

SHA1
d6c7acd13b7890dbeff3b46d465b3c7a402ae098

SHA256
9b786bed14d6b1a7a87a6b2e0d11ccaf4c3d0456752abd412dd332d532862a67

SHA512
4e19a71e1adc2bee517877c70a4dd03b93caef724e471cf9c6d9804d203de900575277301979da5e66790980adf46879f7eb44b3799d97e81c9b7e49ce6323d8

Download Submit
memory/1840-2-0x00000211A7850000-0x00000211A7AC0000-memory.dmp

Filesize
2.4MB

Download
memory/1840-12-0x00000211A5F60000-0x00000211A5F61000-memory.dmp

Filesize
4KB

Download
memory/1840-13-0x00000211A7850000-0x00000211A7AC0000-memory.dmp

Filesize
2.4MB

Download