6a4423b255e84f2d1ca58a153bd423517a5c7013e719061941416760f7ef49d3

Analysis

max time kernel
402s
max time network
446s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik/client_1_16_5/libraries/javabridge-1.0.22.jar
Size

4KB
MD5

3c77e86f133e0bad0bf522474621c324
SHA1

6aa6453aa99a52a5cd91749da1af6ab70e082ab3
SHA256

43fa389f9e18de2bd8fe8bdf924b094153f5f3ba748e84c3052b4f85627fdc0c
SHA512

30c5e1c9d4b98bf893066a7e2879e625806413b281e9fbf89e1f991a9677161b6d4ac9cd276c4740eea8fe7319f38347760316de58b7649dc9fcf65248c5eb50
SSDEEP

96:24hx3n0oAEVqX4UD3SOkYJHhCs9ZrmW2vlx7fPHOK8sQa9:3t0lEVqX7D3S5YvtjPivTvj9

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4140	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4140	4600	java.exe	82
PID 4600 wrote to memory of 4140	4600	java.exe	82

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Nurik\client_1_16_5\libraries\javabridge-1.0.22.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d20fcf80b13efdcf4493e36b6f9102d2

SHA1
cefb0df40c9541229119559fe9ea92e0a202393c

SHA256
27bf9bda385cad6f3673f6fc55a5430a9c558f414ab45e6068affe8dfa43aee4

SHA512
8613c434b9f243a74fdccc9b3a7391cf995607dc0a41e159e53a7e37b3cb603d21fea7c7eeb331bb43a7c69166a5b21aa0a8f57d6febe5555298deed5abdb0c9

Download Submit
memory/4600-4-0x00000284B80F0000-0x00000284B90F0000-memory.dmp

Filesize
16.0MB

Download
memory/4600-12-0x00000284B68A0000-0x00000284B68A1000-memory.dmp

Filesize
4KB

Download
memory/4600-13-0x00000284B80F0000-0x00000284B90F0000-memory.dmp

Filesize
16.0MB

Download