611b014d7e6d599b972852d88e055a1b83d78f94a4eb6ba0901c966b5b6cb40e

Analysis

max time kernel
431s
max time network
1167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v4.6.0/groovy/modules/ext/groovy-ant-3.0.8.jar
Size

85KB
MD5

06d07e7277dfa15590e3590d79423a00
SHA1

3077166ed6635f777064ad79c8ca080ab8dc3247
SHA256

1b0889e67bef955120d8267346d30019ff767efd233ca5441ebbbc8e4a052933
SHA512

4a5cb7d08c573fbfc09494c1e7b8fece032c0f8f99bdf3795df7b374bf8a3140cd585f301f123a0d4260a1c5b19ca497f4a12e0e6544421e3a1718e3a5f4c2c5
SSDEEP

1536:QRrhpNxttH9IXAvgLuB175XXHXU6hZ83aRFfUkrJJ3YdwgO9gHU21ZbdRP2zV2iZ:Q1Nxt3IXA3TXRp7JVgxUwv2zV2rqJ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
876	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 876	2980	java.exe	98
PID 2980 wrote to memory of 876	2980	java.exe	98

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\v4.6.0\groovy\modules\ext\groovy-ant-3.0.8.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
3eed2a9b6911990ee48258c04f86b8d9

SHA1
1ac225fd2178873f73c7934bd6b0dbe870ac5b3b

SHA256
95caae83ec6ebed234eb9f5c14c423839430af2971a5c013042878713b40e708

SHA512
4fb26e8bdfaac6ab4a62c6708ae073994c7b6d0375fd206b85d55bca8d017301f72a1ddd6062e3ea271ad265c7f0bbf36a09df5e6cbcce06e8dbfcc1b71faede

Download Submit
memory/2980-4-0x0000021AAB5F0000-0x0000021AAC5F0000-memory.dmp

Filesize
16.0MB

Download
memory/2980-12-0x0000021AA9DB0000-0x0000021AA9DB1000-memory.dmp

Filesize
4KB

Download