6a4423b255e84f2d1ca58a153bd423517a5c7013e719061941416760f7ef49d3

Analysis

max time kernel
581s
max time network
612s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik/client_1_16_5/libraries/icu4j-66.1.jar
Size

12.3MB
MD5

667638ab9d9afa07e21e618e37662db7
SHA1

72c7519b6d91f7a1f993bd44a99fe95d67211b27
SHA256

5dcca993f67fd6c357774f498d49b7e189b1d9a2cfce050cb4ee1dd96c800f1a
SHA512

bd8d716c1561169a74be4f932627921a186b008c964155692bede5e69491eab54109f6a40a2d14a16bdc221e27dbd5938d74743cc9e2e0b47dff933d7964b644
SSDEEP

196608:MH5+RwaPfkDycFb/zGFTh2tE4Sb+g+CUR1hbtBXLcVLmd:MZ/a+ZiVg2WXhsLmd

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2688	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2688	3940	java.exe	89
PID 3940 wrote to memory of 2688	3940	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Nurik\client_1_16_5\libraries\icu4j-66.1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d1d9c7fed1ae95f6edd530e05b061f6c

SHA1
cbef1a3f665a24067274b6b4da51b8ff0d7701d1

SHA256
74022007a0e4de896684d773c69fff960fcc6e70eb01bb4c48c583f52e7fb983

SHA512
7d07586f3c2631c9c2d2748430651ff42ca4d0fff4ab72fba1c5705d83dc3a19eebae9ba7253d583a8c6194abdea1e80b4a05aa1b512cd492d326bea0d1d6ffd

Download Submit
memory/3940-4-0x000002B206910000-0x000002B207910000-memory.dmp

Filesize
16.0MB

Download
memory/3940-12-0x000002B2068F0000-0x000002B2068F1000-memory.dmp

Filesize
4KB

Download
memory/3940-15-0x000002B2068F0000-0x000002B2068F1000-memory.dmp

Filesize
4KB

Download