611b014d7e6d599b972852d88e055a1b83d78f94a4eb6ba0901c966b5b6cb40e

Analysis

max time kernel
1159s
max time network
1171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v4.6.0/groovy/modules/org-netbeans-modules-groovy-editor.jar
Size

1.3MB
MD5

62997d0c627738fe2593073211e1b215
SHA1

cc4e172e73219cd4783c3ce34cc78ca552178052
SHA256

a31d8996a0677fbf88deb94bd2f2005483836a531ae1355f5a61585b841e5a2f
SHA512

faa83db77523729332968bde8596befce02162bbb03b23d4503b30756369b2b5ce0852f0ae34a60e5cc33d0f644966e381674ac2a48654daa5fd5ac76c506554
SSDEEP

12288:ARBhHfHPYVA7IkmgygpritCcEYxwTUBzl4nUWEpn1kjlro8+ac:YvSRktB6Wg1Vkc

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4820	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4820	1540	java.exe	95
PID 1540 wrote to memory of 4820	1540	java.exe	95

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\v4.6.0\groovy\modules\org-netbeans-modules-groovy-editor.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
fcea5d5f8e7df4f5f57952b742a02d39

SHA1
607fa996f7971cae55d71938a7b8756948075641

SHA256
1fb9b3c2c56e9879ddb99b46c576e3bd306cab0a7ba8998bee432ab9dc6ecef6

SHA512
7e98f1a8e93ef3ba95a7f9b7141a97ab30dfe46862cd702439b3662ead288c33020a86161915b7eeab4c82dd175de09e44d8945717b92680b732f9e4e24a1dbc

Download Submit
memory/1540-4-0x00000261326B0000-0x00000261336B0000-memory.dmp

Filesize
16.0MB

Download
memory/1540-12-0x0000026130EA0000-0x0000026130EA1000-memory.dmp

Filesize
4KB

Download