5d12fb93a3f9c48e0863da39809270af03aac542b74f0145aa3fc4e033b36ddf

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MultiMC/jars/JavaCheck.jar
Size

1KB
MD5

a0b69fde80253c8fe9616ead35b6236c
SHA1

cbcb8fcdecbf509f80210ddaed6738ac94ba183f
SHA256

b8a91afe70d3c6aabbba075a0bed9f8f7f2b28ffb2e0b96552b761828e5ed451
SHA512

22fd17c66576fb02bf0b6aea24de2b2d3b6678a6d6d57ce0b47a0df4b2c3c2553d221b01c90f0ba9a9a1e9aa2948a22defb0baa394d69863be4cafe1455b83cf

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1612	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1612	1448	java.exe	85
PID 1448 wrote to memory of 1612	1448	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\MultiMC\jars\JavaCheck.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d4bfdf84276e4e975283bfdf0087c809

SHA1
a2f833885ca33b46ddbc08b1eef8d7a7764fe09b

SHA256
10225f59e791e47edce605b795366af39bab26c65362efe661ec3ddfdc24eb5c

SHA512
c02c6a83c70beb951c0d836da13fbd0d2d8218ae42b0c4aef0d167824bf3848b3537fb2e3caa4a79da401e17552316a70472c1870a6a5e250273f9ab9912aa09

Download Submit
memory/1448-2-0x000001E400000000-0x000001E400270000-memory.dmp

Filesize
2.4MB

Download
memory/1448-12-0x000001E474460000-0x000001E474461000-memory.dmp

Filesize
4KB

Download
memory/1448-13-0x000001E400000000-0x000001E400270000-memory.dmp

Filesize
2.4MB

Download