76a3e2b720d67a77ca968a094d3e64445bea8ca3f0ecdcc45f4c254e21c62f44

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik 1.16.5 crack/java/conf/security/policy/unlimited/default_US_export.policy
Size

146B
MD5

1a08ffdf0bc871296c8d698fb22f542a
SHA1

f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA256

758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
SHA512

4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.policy	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.policy\ = "policy_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\policy_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\policy_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\policy_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\policy_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\policy_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\policy_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2592	2912	cmd.exe	29
PID 2912 wrote to memory of 2592	2912	cmd.exe	29
PID 2912 wrote to memory of 2592	2912	cmd.exe	29
PID 2592 wrote to memory of 2584	2592	rundll32.exe	30
PID 2592 wrote to memory of 2584	2592	rundll32.exe	30
PID 2592 wrote to memory of 2584	2592	rundll32.exe	30
PID 2592 wrote to memory of 2584	2592	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\java\conf\security\policy\unlimited\default_US_export.policy"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\java\conf\security\policy\unlimited\default_US_export.policy
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\java\conf\security\policy\unlimited\default_US_export.policy"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
534dbd2a241ec60abe767506800701d6

SHA1
429657ee6ef15466db9df3b17cc5db77c7531c4e

SHA256
70a0d6ee6b123bce203871bd347f7d0de40b0d52d418fa2071e9aba0d1bbf915

SHA512
b61a65f5ce9b0331d2f4dd05a3b93c21f18f9755074299bdca4320e1c954e22c49250e4af3e97b0089ea1b620166a2a6884311891ac6e6a231754fceadd50c36

Download Submit