94b5a5cc5729f6531032abf15914f57f7f6f6f7cb31fa816373e412ec4ade1fd

Analysis

max time kernel
134s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04-07-2024 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UltimMC/jars/NewLaunch.jar
Size

14KB
MD5

a878a8f8a4fe447b387db36ea333be0b
SHA1

e14e93105deaf657669d3a51cb7a7857da4d4906
SHA256

683d12d9201c799fef4336ecc87445828d22fa44fa2ec7bfa3aaa4c3199ee1b1
SHA512

ff63638d9de6eee4167280c861cea23fe7bc00e5a4af851e5125cc42859a770c23cd2f4e64eda0047770b1933bad6a03d4662365dc5ab17f4118130100238b33
SSDEEP

384:mKIWCoBnP86CMO7GtjWf9ZNjbvew1/AuuIKs8Grc5XbAQMJiQhNocSnvct017bcd:mKI9APZp7of9Zlbm24u/KsprcFbVMUQn

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2284 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4172 wrote to memory of 2284 4172 java.exe icacls.exe
PID 4172 wrote to memory of 2284 4172 java.exe icacls.exe

pid	process
2284	icacls.exe

description	pid	process	target process
PID 4172 wrote to memory of 2284	4172	java.exe	icacls.exe
PID 4172 wrote to memory of 2284	4172	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\UltimMC\jars\NewLaunch.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4172

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2284

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
a32fd141bb8680cb54c166e0c664e4b2

SHA1
7b6b06d8c535910ec57d9ad20f7e4f0760cc568d

SHA256
c49f895aac617f5c5214e76ad8e1d614eb5bdfafab096a6743437bf2d8ba1c64

SHA512
8350e63af76bb5be84a3960f96fbc66c9bf8840586e3ba7e9ef8975cef2ea724c2639aa866847a106f360ef9016b1ce12fcc625655019a702462ffa01b202721

Download Submit
memory/4172-2-0x000001A9D68F0000-0x000001A9D6B60000-memory.dmp

Filesize
2.4MB

Download
memory/4172-12-0x000001A9D5100000-0x000001A9D5101000-memory.dmp

Filesize
4KB

Download
memory/4172-13-0x000001A9D68F0000-0x000001A9D6B60000-memory.dmp

Filesize
2.4MB

Download