| File name: | TL-MCL.jar |
| Full analysis: | https://app.any.run/tasks/ffcbfff9-3f94-4bfe-9e7f-b82b51cb1505 |
| Verdict: | Malicious activity |
| Analysis date: | January 08, 2022, 13:10:51 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | FF103ED40CA66511C6B7CC478DE7F7D5 |
| SHA1: | F370A6DED09C722D71398932E4A27D981FDD7146 |
| SHA256: | 233B4430EF09C22F5C9CADDF0B961FC43C23757659D9EEE1943D939DD5E1BF73 |
| SSDEEP: | 24576:xbeWl2K0A1MRmTcOIRYaB/zClE76SBpR0mZ+lXr0KoP:oUyA2mTbIRDR72mkbS |
MALICIOUS
No malicious indicators.SUSPICIOUS
Uses ICACLS.EXE to modify access control list
- javaw.exe (PID: 3576)
Creates files in the program directory
- javaw.exe (PID: 3576)
Executes JAVA applets
- javaw.exe (PID: 3576)
Checks supported languages
- java.exe (PID: 1592)
- javaw.exe (PID: 3576)
Reads the computer name
- java.exe (PID: 1592)
Creates files in the user directory
- java.exe (PID: 1592)
INFO
Checks supported languages
- icacls.exe (PID: 3832)
Reads the computer name
- icacls.exe (PID: 3832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .spe | | | SPSS Extension (61.8) |
|---|---|---|
| .jar | | | Java Archive (29.8) |
| .zip | | | ZIP compressed archive (8.2) |
EXIF
ZIP
| ZipFileName: | META-INF/ |
|---|---|
| ZipUncompressedSize: | - |
| ZipCompressedSize: | 2 |
| ZipCRC: | 0x00000000 |
| ZipModifyDate: | 2021:11:11 12:38:10 |
| ZipCompression: | Deflated |
| ZipBitFlag: | 0x0800 |
| ZipRequiredVersion: | 10 |
Total processes
38
Monitored processes
3
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1592 | "C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -Xmx128m -Dfile.encoding=UTF-8 -Dtlauncher.systemCharset=windows-1252 -Dtlauncher.logFolder=C:\Users\admin\AppData\Roaming\.tlauncher\logs -classpath C:\Users\admin\Downloads\TL-MCL.jar ru.turikhay.tlauncher.bootstrap.Bootstrap | C:\Program Files\Java\jre1.8.0_271\bin\java.exe | javaw.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 3576 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\Downloads\TL-MCL.jar" | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 3832 | C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M | C:\Windows\system32\icacls.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 705
Read events
1 701
Write events
4
Delete events
0
Modification events
| (PID) Process: | (1592) java.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: java.exe | |||
| (PID) Process: | (1592) java.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
20
Suspicious files
46
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1592 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher3124728616134342657.tmp | compressed | |
MD5:— | SHA256:— | |||
| 1592 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\mcl.jar | compressed | |
MD5:— | SHA256:— | |||
| 1592 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\com\moandjiezana\toml\toml4j\0.7.2\toml4j-0.7.2.jar | compressed | |
MD5:EFAEC2FAC998DCE5BC118362BF724527 | SHA256:F5475E63E7E89E5DB62223489AEC7A56BD303543772077A17C2CB54C19CA3A20 | |||
| 1592 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher7031039697813839562.tmp | compressed | |
MD5:EFAEC2FAC998DCE5BC118362BF724527 | SHA256:F5475E63E7E89E5DB62223489AEC7A56BD303543772077A17C2CB54C19CA3A20 | |||
| 1592 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\com\github\zafarkhaja\java-semver\0.9.0\java-semver-0.9.0.jar | compressed | |
MD5:9417096FF6A9DB74DB273ABBDA0F334E | SHA256:2218C73B40F9AF98B570D084420C1B4A81332297BD7FC27DDD552E903BE8E93C | |||
| 1592 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher4022509513226221355.tmp | compressed | |
MD5:9417096FF6A9DB74DB273ABBDA0F334E | SHA256:2218C73B40F9AF98B570D084420C1B4A81332297BD7FC27DDD552E903BE8E93C | |||
| 1592 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\com\google\code\gson\gson\2.8.9\gson-2.8.9.jar | java | |
MD5:E67627F67E03301092DC7DE0A2D7CEF8 | SHA256:D3999291855DE495C94C743761B8AB5176CFEABE281A5AB0D8E8D45326FD703E | |||
| 1592 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\org\slf4j\slf4j-api\1.7.32\slf4j-api-1.7.32.jar | compressed | |
MD5:FBCF58513BC25B80F075D812AAD3E3CF | SHA256:3624F8474C1AF46D75F98BC097D7864A323C81B3808AA43689A6E1C601C027BE | |||
| 1592 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher7383954344251084302.tmp | java | |
MD5:57C2FBFEB55E307CCAE52E5322082E02 | SHA256:211B306CFC44F8F96DF3A0A3DDAF75BA8C5289EED77D60D72F889BB855F535E5 | |||
| 1592 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\com\fasterxml\jackson\core\jackson-core\2.13.0\jackson-core-2.13.0.jar | java | |
MD5:94E04ABCCAB99E295A3F4F57F6E387C8 | SHA256:348BC59B348DF2E807B356F1D62D2AFB41A974073328ABC773EB0932B855D2C8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
17
DNS requests
11
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1592 | java.exe | 78.47.139.76:443 | u.tlauncher.ru | Hetzner Online GmbH | DE | suspicious |
1592 | java.exe | 185.178.208.161:443 | repo.tlaun.ch | Ddos-guard Ltd | RU | suspicious |
1592 | java.exe | 135.125.37.31:443 | tlauncherrepo.com | Avaya Inc. | US | suspicious |
1592 | java.exe | 172.67.173.53:443 | tlaun.ch | — | US | malicious |
1592 | java.exe | 13.225.79.128:443 | launchermeta.mojang.com | — | US | suspicious |
1592 | java.exe | 143.204.203.76:443 | authserver.mojang.com | — | US | unknown |
— | — | 40.90.65.55:443 | launchercontent.mojang.com | Microsoft Corporation | US | unknown |
1592 | java.exe | 151.236.71.1:443 | cdn.turikhay.ru | CDNvideo LLC | RU | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
cdn.turikhay.ru |
| suspicious |
u.tlauncher.ru |
| suspicious |
repo.tlaun.ch |
| suspicious |
tlauncherrepo.com |
| unknown |
launchermeta.mojang.com |
| whitelisted |
tlaun.ch |
| unknown |
tlauncher.ru |
| suspicious |
stats.tlauncher.ru |
| suspicious |
launchercontent.mojang.com |
| whitelisted |
authserver.mojang.com |
| suspicious |