6a4423b255e84f2d1ca58a153bd423517a5c7013e719061941416760f7ef49d3

Analysis

max time kernel
433s
max time network
454s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik/client_1_16_5/libraries/gson-2.10.1.jar
Size

276KB
MD5

df6097815738cb31fc56391553210843
SHA1

b3add478d4382b78ea20b1671390a858002feb6c
SHA256

4241c14a7727c34feea6507ec801318a3d4a90f070e4525681079fb94ee4c593
SHA512

7503e4b8d05c6cc0ecb3a94c5a2e070e049083a441003a79a0cdf474f4286699b4ba1d2a655ddabb8ba10c50e7c36a7045cccdaee465166d4630db647aba2727
SSDEEP

3072:p4WGydWjBhxyrhQG8L58iASUZNKszf+KRb2nkqzcKxrKGKXukGjPphbeT9ctyCmA:OWGydCfxAJKsr+yKoKRKNGjPMLA

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1584	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1584	1160	java.exe	87
PID 1160 wrote to memory of 1584	1160	java.exe	87

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Nurik\client_1_16_5\libraries\gson-2.10.1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
9ad623e940d2aa80e5db998c5aff7084

SHA1
f820b34265b61ab1f73e9ebae88066039e554523

SHA256
595e06fe56ffe5040f61fe71bb5bdec9cc52fde31e312aafb8f819006d4206bb

SHA512
0be00516e988876ffab757df688e38fd3d540f3fa79c980514ea287827147c28a427edbba983e3cdf2026d67ce725b43540ed3d929dc008bd029f3fce997f64a

Download Submit
memory/1160-4-0x00000162015A0000-0x00000162025A0000-memory.dmp

Filesize
16.0MB

Download
memory/1160-11-0x000001627FD10000-0x000001627FD11000-memory.dmp

Filesize
4KB

Download
memory/1160-13-0x00000162015A0000-0x00000162025A0000-memory.dmp

Filesize
16.0MB

Download