6a4423b255e84f2d1ca58a153bd423517a5c7013e719061941416760f7ef49d3

Analysis

max time kernel
417s
max time network
437s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik/client_1_16_5/libraries/gson-2.8.0.jar
Size

226KB
MD5

a42f1f5bfa4e6f123ddcab3de7e0ff81
SHA1

c4ba5371a29ac9b2ad6129b1d39ea38750043eff
SHA256

c6221763bd79c4f1c3dc7f750b5f29a0bb38b367b81314c4f71896e340c40825
SHA512

740f66ddd5d46ef9f8da97b2f53299aff64cadbffc15217f0b26dc6dc7d53b140b16b3d09d22f72b223d7f85740dd6c2e1951ce57b4c06f5ba795fc17df30cfd
SSDEEP

3072:TCpUb6hCZr3L4GZjnhgwm2m4noUNVZBM32XCcZPRrpkLQI3WvVBmKQh/kdem9IcI:TLhZ5jiioRmSclRtyQmWvVBr8mOcLCb

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1876	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1876	3076	java.exe	88
PID 3076 wrote to memory of 1876	3076	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Nurik\client_1_16_5\libraries\gson-2.8.0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
805a66e17c2e7531349bda88644a0baa

SHA1
cde31919fa330c47765cefba8a7803c980bfcaeb

SHA256
905eb36c8858be7f5cc5b60ce8c4f5462ffe077ddbcccaa1c0803024a6613c70

SHA512
002a7a33351f603fc296549490c8da7e3bc0f8f111963917a087e46dac7e3173b3c9d69ae42b997331b4a5c9708c199a2ed39d9693663ce2487875344e0da64e

Download Submit
memory/3076-4-0x000001E7C7C20000-0x000001E7C8C20000-memory.dmp

Filesize
16.0MB

Download
memory/3076-10-0x000001E7C7C00000-0x000001E7C7C01000-memory.dmp

Filesize
4KB

Download
memory/3076-13-0x000001E7C7C20000-0x000001E7C8C20000-memory.dmp

Filesize
16.0MB

Download