Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    561s
  • max time network
    843s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 15:08

General

  • Target

    Nurik/client_1_16_5/libraries/commons-io-2.5.jar

  • Size

    203KB

  • MD5

    e2d74794fba570ec2115fb9d5b05dc9b

  • SHA1

    2852e6e05fbb95076fc091f6d1780f1f8fe35e0f

  • SHA256

    a10418348d234968600ccb1d988efcbbd08716e1d96936ccc1880e7d22513474

  • SHA512

    1f6bfc215da9ae661dbabba80a0f29101a2d5e49c7d0c6ed760d1cafea005b7f0ff177b3b741e75b8e59804b0280fa453a76940b97e52b800ec03042f1692b07

  • SSDEEP

    6144:m4kN4FYEA+xWF9BfM4xm22MR6YQJlvyRpdw:hkuxQnfnxm22o6zfvWpq

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\Nurik\client_1_16_5\libraries\commons-io-2.5.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:5012
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5372,i,6862816582779850255,3437582573780299282,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
    1⤵
      PID:4500

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

      Filesize

      46B

      MD5

      6f8c5a7535d0eeee03fde200e7bddee0

      SHA1

      fcbcd442702a5db3a9f4cd0863fad71b97211b2e

      SHA256

      6c4f566ed9712f41edde5ef1edbe395b0f9a73ac87e5c3d9b10bdf2477af837f

      SHA512

      62d57f29631866356758807c3245c5168a143f852b1df33a43646dee46eefcf7880c4834ce3d8192a85fcfe3d54feed8d2db51f5d26aa35041f96b8f6f18c1ba

    • memory/1188-2-0x00000246EBFC0000-0x00000246ECFC0000-memory.dmp

      Filesize

      16.0MB

    • memory/1188-12-0x00000246EA710000-0x00000246EA711000-memory.dmp

      Filesize

      4KB