05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf

Analysis

max time kernel
102s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SKlauncher-3.2.exe
Size 1.6MB
Sample240603-wbcbxsfc33
SHA256 05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
MD5 b63468dd118dfbca5ef7967ba344e0e3
SHA1 2ba4f0df5f3bd284bf2a89aba320e4440d8b8355
SHA512 007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548
SSDEEP 49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1448	SKlauncher-3.2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
696	icacls.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1448	SKlauncher-3.2.exe
1448	SKlauncher-3.2.exe
1448	SKlauncher-3.2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4468	1448	SKlauncher-3.2.exe	83
PID 1448 wrote to memory of 4468	1448	SKlauncher-3.2.exe	83
PID 4468 wrote to memory of 696	4468	java.exe	86
PID 4468 wrote to memory of 696	4468	java.exe	86
PID 1448 wrote to memory of 2824	1448	SKlauncher-3.2.exe	88
PID 1448 wrote to memory of 2824	1448	SKlauncher-3.2.exe	88
PID 1448 wrote to memory of 4420	1448	SKlauncher-3.2.exe	94
PID 1448 wrote to memory of 4420	1448	SKlauncher-3.2.exe	94

C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- \??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
  "c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:696
- \??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
  "c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:2824
- C:\Windows\SYSTEM32\reg.exe
  reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
  2⤵
  PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 81865a9414a0413342712258f093e954f3e1805c767a0f640a8819c893e43283
MD5 c7ce90586480d7a1b9a6866d15968adb
SHA1 e5db7f8ebdc186f97f80d4474ffce1959c36b8fc
SHA512 f83c9f324e1dcd3f3f07dd5c31fde9b0f101d606bdd8c5ebcf1c389bb1f34fa9b92676919ff1f8dd6049ca9aa1ce526240383ec42f40f30a774f2a09be476533
MD5 SHA1 SHA512

Submit Download

+JXF2334418516384960358.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF2334418516384960358.tmp
Size 398KB
SHA256 1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1
MD5 ff5fdc6f42c720a3ebd7b60f6d605888
SHA1 460c18ddf24846e3d8792d440fd9a750503aef1b
SHA512 d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3
SSDEEP 6144:oeroPfXwF22mZ8JWPziKSQYfW0LXYveHt+47O3YqF5nxeU2h8jjXVymj3k4yhb18:ovw22mZzPziKYW0jYves4I2n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF7588255383702813983.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF7588255383702813983.tmp
Size 405KB
SHA256 0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1
MD5 8f2869a84ad71f156a17bb66611ebe22
SHA1 0325b9b3992fa2fdc9c715730a33135696c68a39
SHA512 3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834
SSDEEP 12288:k9zC2w597PziK+bSvkK3sgUN8HkC48AeIVMhQ/8:e4iK+6I/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF8998453087119827324.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF8998453087119827324.tmp
Size 397KB
SHA256 64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123
MD5 fdb50e0d48cdcf775fa1ac0dc3c33bd4
SHA1 5c95e5d66572aeca303512ba41a8dde0cea92c80
SHA512 20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53
SSDEEP 6144:sSnv4lXwF22mZ8JWPziKSQUmeKGVOOxAdgwH9evDFDynor51EOO2UAGbzxSr1w7b:sSvJ22mZzPziKwLOOkvH9IQoUf7P08
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKlauncher-3.2.jar

Path C:\Users\Admin\AppData\Local\Temp\e4j4527.tmp_dir1717436671\SKlauncher-3.2.jar
Size 1.1MB
SHA256 f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350
MD5 4d653e61ba01a521c56b9a70a9c9814e
SHA1 de855dc3dbc914b497b58da92e0c21fff660796d
SHA512 e6a7db6e2893b5b01dd0c84a230d88abf50da63ceb1af5754a2c4c1fbd307a799a74f3f368430d3beb33590cda2e0a3cf509fef11c4477b76e8d3c4a582b5def
SSDEEP 24576:cABupJWa7eXYJ4FCDzQvrmqBqAXxKhd1ODQZ3z0IH8obxOaHmez6Im:JgxzIvrWphdcDQZ3jH8olVGezFm
MD5 SHA1 SHA512 SSDEEP

Submit Download

flatlaf-windows-x86_64-4572518318900.dll

Path C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4572518318900.dll
Size 22KB
SHA256 ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c
MD5 dcd68a87b7e6edbcfde48150403b22eb
SHA1 28e4839a29725075772fccc39b44e194eb91e477
SHA512 ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71
SSDEEP 384:6pPX3l1FuqkXq3NhzDuWik7DPObNpwKNsOfJ8APxh8E9VF0NyXKss:Ydiq4UzQkG2eJ/PxWERc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sklauncher-fx.jar

Path C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar
Size 14.1MB
SHA256 fab6dede2f59dc4b7b6be032fbce1209a93aca02b7d6c126e3f1584148230146
MD5 9b59fa715db2f9f8f6ed9e14f3768ed3
SHA1 9d46c5898c653fb1785e399b74f26633107d0bde
SHA512 e9e84b056e0f1d8be544194a275ca61b5e6820dbbd701dec5aa75b804705ab33cb826314c0f6edd527cffa84de80062c559f9fb49c53b5bbfda9481bd138be5f
SSDEEP 196608:kqiVludr9bZqBewAtdZzTM/dMjfBhBmkJZn2KBH5yzKWh2+v/+H6hFikjbE7:kMh9bZqe7/M2fMkzn2KtWw+eHKnHC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1448-149-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-208-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-49-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-34-0x00000000022C0000-0x0000000002530000-memory.dmp

Download

memory/1448-81-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-121-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-138-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-756-0x00000000022C0000-0x0000000002530000-memory.dmp

Download

memory/1448-239-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-172-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-186-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-45-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-216-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-234-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/1448-233-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/2824-31-0x00000214D3430000-0x00000214D36A0000-memory.dmp

Download

memory/2824-30-0x00000214D3410000-0x00000214D3411000-memory.dmp

Download

memory/2824-20-0x00000214D3430000-0x00000214D36A0000-memory.dmp

Download

memory/4468-17-0x0000028F4CCE0000-0x0000028F4CF50000-memory.dmp

Download

memory/4468-15-0x0000028F4B410000-0x0000028F4B411000-memory.dmp

Download

memory/4468-5-0x0000028F4CCE0000-0x0000028F4CF50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads