6a4423b255e84f2d1ca58a153bd423517a5c7013e719061941416760f7ef49d3

Analysis

max time kernel
529s
max time network
593s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik/client_1_16_5/libraries/commons-compress-1.8.1.jar
Size

356KB
MD5

d862e30ff6b5d78264677dcd6507abb8
SHA1

a698750c16740fd5b3871425f4cb3bbaa87f529d
SHA256

5fca136503f86ecc6cb61fbd17b137d59e56b45c7a5494e6b8fd3cabd4697fbd
SHA512

5f254bffa74bd5a58581ae304a54d127db8a5f68e4d265594ec547013287a87716ce7a60dfa5e19f2ae8a6c75670d25ddf89eab764caf882def1a17e7d3cfddf
SSDEEP

6144:HIoZhGubbnAzKczHsqUQFTQqXjiwZqldgfIFlR2WLbQE48hjtumzf:oo+N15UEJXjiJHZv5bQE1uOf

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4964	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4964	8	java.exe	88
PID 8 wrote to memory of 4964	8	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Nurik\client_1_16_5\libraries\commons-compress-1.8.1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
5b88a7bb14fab25a321a4a7d11b5ad3f

SHA1
e84cac66ad5f42f1d5b8fb07216cd317ab94711f

SHA256
332f51e02efcb6b33127239a6bca90da50b4d6329bc26331d84665653b5aabaa

SHA512
de8e832feb297b6969f0eb64655c9e81cbc86675ca3a59fdeac5f09fcc75584bb60e2dc0e7a8b72b167e9c302b445fc30ffd28845f4421b6b74e7338d6fe70d1

Download Submit
memory/8-4-0x000001911B930000-0x000001911C930000-memory.dmp

Filesize
16.0MB

Download
memory/8-12-0x000001911A080000-0x000001911A081000-memory.dmp

Filesize
4KB

Download
memory/8-14-0x000001911B930000-0x000001911C930000-memory.dmp

Filesize
16.0MB

Download