ee9fcb4977064a6ebfadb81b1e33e806c96c6256e7f49a474f91d974ec12a709

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jenny-Mod-Forge-1.12.2-v1.9.0.jar
Size 42.6MB
Sample240613-bk822aydpd
SHA256 ee9fcb4977064a6ebfadb81b1e33e806c96c6256e7f49a474f91d974ec12a709
MD5 9055ee21e25c501d68d16cca6f15d482
SHA1 5c310dac45d3a6039a9e182f948f1569af4683e2
SHA512 b5d8119bee3ec53600f7c8ba6e26735966577eaea6feaa21b2983d02a27c8dbbef2b6f45e161b4a7527c7bfd1b996492407112b64e759944f247d3d2ee0d9600
SSDEEP 786432:/KV7lHfurN3Fg4r2W9FXlHt5LnCKDjOjATOd1LlsnedAj8w9IDtM31B:/KVtgN3L59V9CcgUa1LrULB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3108	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 3108	3228	java.exe	85
PID 3228 wrote to memory of 3108	3228	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Jenny-Mod-Forge-1.12.2-v1.9.0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 7058f434a91b26c87fd5b90ab00785bb64d4922af38494be679986bb957ca25f
MD5 12845fd16c059c6203f393e87edc6052
SHA1 47f0e966365656b93cecf9a967b2eb06512d5514
SHA512 8babf99b71cc5ca18e95c3beeba322ad5a487ad350772cc30133bf521babe87f536d7e8dc1084fb6257dbc9b6f2b096f4b19fc1b35ee78ae41402331e6119b5c
MD5 SHA1 SHA512

Submit Download

memory/3228-2-0x000001E7D7CF0000-0x000001E7D7F60000-memory.dmp

Download

memory/3228-12-0x000001E7D7CD0000-0x000001E7D7CD1000-memory.dmp

Download

memory/3228-13-0x000001E7D7CF0000-0x000001E7D7F60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads