6a4423b255e84f2d1ca58a153bd423517a5c7013e719061941416760f7ef49d3

Analysis

max time kernel
407s
max time network
456s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik/client_1_16_5/libraries/guava-21.0.jar
Size

2.4MB
MD5

ddc91fd850fa6177c91aab5d4e4d1fa6
SHA1

3a3d111be1be1b745edfa7d91678a12d7ed38709
SHA256

972139718abc8a4893fa78cba8cf7b2c903f35c97aaf44fa3031b0669948b480
SHA512

6730a5f8f6b0c1a8fe7ca5e5836056e1109ffc0be9a285796f829927a75a54485ac923e45896a6ee713a40e217c3cf7a5fed52f6a1ff21db57f908216d151a2a
SSDEEP

49152:faibjnhshKLKay2wd4+IsAf4wsAFckxlPyT6bwvgQSpdXkiFls13+I9yN+hxL1pP:faatLKay2/NsPwPc6lqTgQSbX8j

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5068	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 5068	1768	java.exe	86
PID 1768 wrote to memory of 5068	1768	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Nurik\client_1_16_5\libraries\guava-21.0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
9c87a2cd7f70351f109251e4804f73cf

SHA1
badf4e3866d88dbfcb2fe9c79fd7a170370439c0

SHA256
0318be437fc2169dc9ebd245b1b2b4cf5c461e316a5e7833e4141f7e9bb1697e

SHA512
022e87400ad4b77fedcb6b1180387a804022d5e3314cf636a23865f1382afa4d70af8c4eb183f23bb8801e222aaba79307eadca24f2831904f383f1ee28d4019

Download Submit
memory/1768-4-0x000001D50B340000-0x000001D50C340000-memory.dmp

Filesize
16.0MB

Download
memory/1768-11-0x000001D509A60000-0x000001D509A61000-memory.dmp

Filesize
4KB

Download
memory/1768-13-0x000001D50B340000-0x000001D50C340000-memory.dmp

Filesize
16.0MB

Download