611b014d7e6d599b972852d88e055a1b83d78f94a4eb6ba0901c966b5b6cb40e

Analysis

max time kernel
1155s
max time network
1173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v4.6.0/groovy/modules/org-netbeans-modules-libs-groovy.jar
Size

28KB
MD5

a0f8d09e8ed1a3a621937d8abb286066
SHA1

18af90df506f441a0958cf0e4083d98bebfcd490
SHA256

ce455328090ca4ceb3688e7b9dd403645e2e5b4c283215ae6111cdff4d3396c0
SHA512

3f2168542206689d0185d0ad7100a0b99afd5cb22bca943bbd503bc6dd8f9b043ec381eb4ff82bd84a73d504026c527c1822541f09417d0cf5a38814ad2d60fc
SSDEEP

384:mY/n9vlKM1zJlFvmNz5VrlkTS07Hl+KT6djqI/h7fA7TJ:9/n9TzJlFvAfxk1rsfVZcp

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3976	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 3976	1112	java.exe	97
PID 1112 wrote to memory of 3976	1112	java.exe	97

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\v4.6.0\groovy\modules\org-netbeans-modules-libs-groovy.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
49f84bb9d004899f7770a0022d6c8fde

SHA1
6b6d181496963d1a43682522b7e490152ad4fd33

SHA256
3709a3007bc3903dd282d302bb51c5763c44948118e1000b16f6b8b5a29516ad

SHA512
bdd173d0f80d1247e935bdd956c08e4abfcb8e4735e3aece1c4847d114361124e093dd8815bdb107ae1ee3cfc9df6720c3b3da40074384bb9b2b724b8c4c414d

Download Submit
memory/1112-2-0x0000014A00000000-0x0000014A01000000-memory.dmp

Filesize
16.0MB

Download
memory/1112-12-0x0000014A79310000-0x0000014A79311000-memory.dmp

Filesize
4KB

Download