c29379ad77c234ec161faa837487b6dea9dbd14ce6294e1d0b6878a576ae7f58

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik 1.16.5 crack/client/libraries/commons-compress-1.8.1.jar
Size

356KB
MD5

d862e30ff6b5d78264677dcd6507abb8
SHA1

a698750c16740fd5b3871425f4cb3bbaa87f529d
SHA256

5fca136503f86ecc6cb61fbd17b137d59e56b45c7a5494e6b8fd3cabd4697fbd
SHA512

5f254bffa74bd5a58581ae304a54d127db8a5f68e4d265594ec547013287a87716ce7a60dfa5e19f2ae8a6c75670d25ddf89eab764caf882def1a17e7d3cfddf
SSDEEP

6144:HIoZhGubbnAzKczHsqUQFTQqXjiwZqldgfIFlR2WLbQE48hjtumzf:oo+N15UEJXjiJHZv5bQE1uOf

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4240 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2572 wrote to memory of 4240 2572 java.exe icacls.exe
PID 2572 wrote to memory of 4240 2572 java.exe icacls.exe

pid	process
4240	icacls.exe

description	pid	process	target process
PID 2572 wrote to memory of 4240	2572	java.exe	icacls.exe
PID 2572 wrote to memory of 4240	2572	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\client\libraries\commons-compress-1.8.1.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
d6ebaefcf3c914fce5322c264bf31602

SHA1
4a2ac78ffd5c54c89bc26d0cf0f61f18d75dc0ad

SHA256
7b171223dce5629eb57c98d9a791a34c9aecb1835683fdc967f5206cde34a2e0

SHA512
b4cc3eb800f8d79603a82b4b7c04fb23282581ad1cb90242065de03a53b5f4683cecbd4efd6c20d8ec19898de4015564d86e942dbc723895054abfcd187d50ac

Download Submit
memory/2572-2-0x0000017E30B50000-0x0000017E30DC0000-memory.dmp

Filesize
2.4MB

Download
memory/2572-13-0x0000017E30B30000-0x0000017E30B31000-memory.dmp

Filesize
4KB

Download
memory/2572-14-0x0000017E30B50000-0x0000017E30DC0000-memory.dmp

Filesize
2.4MB

Download