b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
137s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/libraries/java/launcher.jar
Size

3.9MB
MD5

6e95940ae024d3df5650fb4b41700f98
SHA1

aac608966eb28d03a7293c70d69a43d964d3dab3
SHA256

61ab765fa1f743d34d84e0415144cbff5604ecb7a91370f1ee658f964602afc9
SHA512

260b5b6a50ee5df6db1dbfcb38f2dcaf177bd4198271d7eff67b8b6ea178b362d486334a09d82fddee0e41bebb28cba57280a6fe8da615bf57fd0fc3a5fa5e3d
SSDEEP

98304:BC2Ohx/Z31FiSZO9ZmmGaOVsnYalangjF63lOMM+q:zyV98nOVAAa2hM+q

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3124	icacls.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1744	java.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3124	1744	java.exe	96
PID 1744 wrote to memory of 3124	1744	java.exe	96
PID 1744 wrote to memory of 1148	1744	java.exe	98
PID 1744 wrote to memory of 1148	1744	java.exe	98
PID 1148 wrote to memory of 3132	1148	cmd.exe	99
PID 1148 wrote to memory of 3132	1148	cmd.exe	99

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\resources\libraries\java\launcher.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Program Files\Java\jre-1.8\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr
    3⤵
    PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3776,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
12b6ee58bb3e2c24c6fc5594978de3d4

SHA1
5e2413ab8e4ffaa8a7dc2536917ac905fbd4f54b

SHA256
2d9f940201a0e8331dbd3fdf7c4966181dbfc0036f8600e26e3615299ec99cc4

SHA512
7c281c005d9381d4d3392ab4796089dea50003053e1cc6c91df78b4c6706f16802f72a7589ee21d117a611c5ec412d4e0b4e93685acff706a3d313a879bdad7c

Download Submit
memory/1744-2-0x00000171A4FF0000-0x00000171A5260000-memory.dmp

Filesize
2.4MB

Download
memory/1744-15-0x00000171A3700000-0x00000171A3701000-memory.dmp

Filesize
4KB

Download
memory/1744-23-0x00000171A4FF0000-0x00000171A5260000-memory.dmp

Filesize
2.4MB

Download
memory/1744-20-0x00000171A3700000-0x00000171A3701000-memory.dmp

Filesize
4KB

Download
memory/3132-19-0x0000022D9AF80000-0x0000022D9B1F0000-memory.dmp

Filesize
2.4MB

Download
memory/3132-30-0x0000022D99680000-0x0000022D99681000-memory.dmp

Filesize
4KB

Download
memory/3132-31-0x0000022D9AF80000-0x0000022D9B1F0000-memory.dmp

Filesize
2.4MB

Download