Overview
overview
10Static
static
10Nurik 1.16...er.exe
windows7-x64
1Nurik 1.16...er.exe
windows10-2004-x64
1Nurik 1.16...36.ps1
windows7-x64
3Nurik 1.16...36.ps1
windows10-2004-x64
3Nurik 1.16...4e.ps1
windows7-x64
3Nurik 1.16...4e.ps1
windows10-2004-x64
3Nurik 1.16...28.jar
windows7-x64
1Nurik 1.16...28.jar
windows10-2004-x64
7Nurik 1.16...17.jar
windows7-x64
1Nurik 1.16...17.jar
windows10-2004-x64
7Nurik 1.16....0.jar
windows7-x64
1Nurik 1.16....0.jar
windows10-2004-x64
7Nurik 1.16...10.jar
windows7-x64
1Nurik 1.16...10.jar
windows10-2004-x64
7Nurik 1.16....1.jar
windows7-x64
1Nurik 1.16....1.jar
windows10-2004-x64
7Nurik 1.16....5.jar
windows7-x64
1Nurik 1.16....5.jar
windows10-2004-x64
7Nurik 1.16....5.jar
windows7-x64
1Nurik 1.16....5.jar
windows10-2004-x64
7Nurik 1.16....3.jar
windows7-x64
1Nurik 1.16....3.jar
windows10-2004-x64
7Nurik 1.16...26.jar
windows7-x64
1Nurik 1.16...26.jar
windows10-2004-x64
7Nurik 1.16...pc.jar
windows7-x64
1Nurik 1.16...pc.jar
windows10-2004-x64
7Nurik 1.16....9.jar
windows7-x64
1Nurik 1.16....9.jar
windows10-2004-x64
7Nurik 1.16....1.jar
windows7-x64
1Nurik 1.16....1.jar
windows10-2004-x64
7Nurik 1.16....0.jar
windows7-x64
1Nurik 1.16....0.jar
windows10-2004-x64
7Analysis
-
max time kernel
142s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 16:04
Behavioral task
behavioral1
Sample
Nurik 1.16.5 crack/CrackLauncher.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Nurik 1.16.5 crack/CrackLauncher.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Nurik 1.16.5 crack/client/assets/objects/90/90046a9705756370acd9a00502aab5785a2c2136.ps1
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Nurik 1.16.5 crack/client/assets/objects/90/90046a9705756370acd9a00502aab5785a2c2136.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Nurik 1.16.5 crack/client/assets/objects/c3/c3cd0db760c980287b26ef9c0894f66c4250724e.ps1
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Nurik 1.16.5 crack/client/assets/objects/c3/c3cd0db760c980287b26ef9c0894f66c4250724e.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
Nurik 1.16.5 crack/client/libraries/authlib-2.1.28.jar
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
Nurik 1.16.5 crack/client/libraries/authlib-2.1.28.jar
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
Nurik 1.16.5 crack/client/libraries/brigadier-1.0.17.jar
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Nurik 1.16.5 crack/client/libraries/brigadier-1.0.17.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Nurik 1.16.5 crack/client/libraries/ca-fixer-1.0.jar
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Nurik 1.16.5 crack/client/libraries/ca-fixer-1.0.jar
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
Nurik 1.16.5 crack/client/libraries/commons-codec-1.10.jar
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Nurik 1.16.5 crack/client/libraries/commons-codec-1.10.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Nurik 1.16.5 crack/client/libraries/commons-compress-1.8.1.jar
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
Nurik 1.16.5 crack/client/libraries/commons-compress-1.8.1.jar
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
Nurik 1.16.5 crack/client/libraries/commons-io-2.5.jar
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
Nurik 1.16.5 crack/client/libraries/commons-io-2.5.jar
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Nurik 1.16.5 crack/client/libraries/commons-lang3-3.5.jar
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Nurik 1.16.5 crack/client/libraries/commons-lang3-3.5.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Nurik 1.16.5 crack/client/libraries/commons-logging-1.1.3.jar
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
Nurik 1.16.5 crack/client/libraries/commons-logging-1.1.3.jar
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
Nurik 1.16.5 crack/client/libraries/datafixerupper-4.0.26.jar
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
Nurik 1.16.5 crack/client/libraries/datafixerupper-4.0.26.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Nurik 1.16.5 crack/client/libraries/discord-rpc.jar
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
Nurik 1.16.5 crack/client/libraries/discord-rpc.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Nurik 1.16.5 crack/client/libraries/fastutil-8.5.9.jar
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
Nurik 1.16.5 crack/client/libraries/fastutil-8.5.9.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Nurik 1.16.5 crack/client/libraries/gson-2.10.1.jar
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
Nurik 1.16.5 crack/client/libraries/gson-2.10.1.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
Nurik 1.16.5 crack/client/libraries/gson-2.8.0.jar
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
Nurik 1.16.5 crack/client/libraries/gson-2.8.0.jar
Resource
win10v2004-20240611-en
General
-
Target
Nurik 1.16.5 crack/CrackLauncher.exe
-
Size
101KB
-
MD5
8af6fddaaaa1e49fd726f573fe69fba7
-
SHA1
ccc52eb5c92fb85a8df177ffb467fe9aba2a0cb6
-
SHA256
69623ca675497a9bf5b703eaf88d1067704ae004ff16df2e6a26214138776f4b
-
SHA512
a0a47ed93a00e5849b5a99e520c39db4efeca7e0e8699e2aa27efebbc000ed908a6c776289c5ae1636157cd91d4b41cefa7ea1a954fb224466d94d88c8e9b5f5
-
SSDEEP
1536:MV14sMWfg1AKdTiBjAORN38A/Hdwoja/r6sXxqW4kEEv:u4NWfg1AKdajAOr8A/9wo+/rmW4kEE
Malware Config
Signatures
-
Modifies registry class 9 IoCs
Processes:
CrackLauncher.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347 CrackLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\ = "URL:Run game 1199748644409184347 protocol" CrackLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\URL Protocol CrackLauncher.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\shell\open\command CrackLauncher.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\shell\open CrackLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nurik 1.16.5 crack\\CrackLauncher.exe" CrackLauncher.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\DefaultIcon CrackLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nurik 1.16.5 crack\\CrackLauncher.exe" CrackLauncher.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\discord-1199748644409184347\shell CrackLauncher.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
CrackLauncher.exedescription pid process target process PID 768 wrote to memory of 4380 768 CrackLauncher.exe cmd.exe PID 768 wrote to memory of 4380 768 CrackLauncher.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\CrackLauncher.exe"C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\CrackLauncher.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4380
-