94b5a5cc5729f6531032abf15914f57f7f6f6f7cb31fa816373e412ec4ade1fd

Analysis

max time kernel
133s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-07-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UltimMC/jars/NewLaunch.jar
Size

14KB
MD5

a878a8f8a4fe447b387db36ea333be0b
SHA1

e14e93105deaf657669d3a51cb7a7857da4d4906
SHA256

683d12d9201c799fef4336ecc87445828d22fa44fa2ec7bfa3aaa4c3199ee1b1
SHA512

ff63638d9de6eee4167280c861cea23fe7bc00e5a4af851e5125cc42859a770c23cd2f4e64eda0047770b1933bad6a03d4662365dc5ab17f4118130100238b33
SSDEEP

384:mKIWCoBnP86CMO7GtjWf9ZNjbvew1/AuuIKs8Grc5XbAQMJiQhNocSnvct017bcd:mKI9APZp7of9Zlbm24u/KsprcFbVMUQn

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

508 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1796 wrote to memory of 508 1796 java.exe icacls.exe
PID 1796 wrote to memory of 508 1796 java.exe icacls.exe

pid	process
508	icacls.exe

description	pid	process	target process
PID 1796 wrote to memory of 508	1796	java.exe	icacls.exe
PID 1796 wrote to memory of 508	1796	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\UltimMC\jars\NewLaunch.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:508

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
7c4b10019f30da38f89657fd204eec80

SHA1
ec582cccd6b382fdbf46ca3ab52af0369102f33a

SHA256
ac475fde46bed04b38172dc0824e8d80262097328c561e2cea99a9f0a35d9142

SHA512
93aeb89ec1d3f6832754ab68f76e3fa753a1bd49e33c7e6649e984472d61da6789259307e041172d561320fc8e7d7d6e2221716cfb7d0aa293a8f23fbbd63f84

Download Submit
memory/1796-2-0x000001C515110000-0x000001C515380000-memory.dmp

Filesize
2.4MB

Download
memory/1796-12-0x000001C5138A0000-0x000001C5138A1000-memory.dmp

Filesize
4KB

Download
memory/1796-13-0x000001C515110000-0x000001C515380000-memory.dmp

Filesize
2.4MB

Download