c29379ad77c234ec161faa837487b6dea9dbd14ce6294e1d0b6878a576ae7f58

Analysis

max time kernel
105s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik 1.16.5 crack/client/libraries/commons-lang3-3.5.jar
Size

468KB
MD5

780b5a8b72eebe6d0dbff1c11b5658fa
SHA1

6c6c702c89bfff3cd9e80b04d668c5e190d588c6
SHA256

8ac96fc686512d777fca85e144f196cd7cfe0c0aec23127229497d1a38ff651c
SHA512

9e6ff20e891b6835d5926c90f237d55931e75723c8b88d6417926393e077e71013dab006372d34a6b5801e6ca3ce080a00f202cba700cab5aabfc17bbbdcab36
SSDEEP

12288:RXWoN+vjrk1GDSZSYPv46XEfJtBaR7QDbC2:RXj0vk1qASSzs22

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3628 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3376 wrote to memory of 3628 3376 java.exe icacls.exe
PID 3376 wrote to memory of 3628 3376 java.exe icacls.exe

pid	process
3628	icacls.exe

description	pid	process	target process
PID 3376 wrote to memory of 3628	3376	java.exe	icacls.exe
PID 3376 wrote to memory of 3628	3376	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Nurik 1.16.5 crack\client\libraries\commons-lang3-3.5.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
44570bf7ed7e028b995aa140515d4339

SHA1
4fedfc197d3049cc5eaf45fcb887052761a7811b

SHA256
a6643cc1440bbcfdd4a16777b37956a574e792806e62fa7c67d1878385aceb7d

SHA512
b80ba0dc148baa629e7768c6bf003a0fb75a7eb0e60ba3f06c1857d69de7d9b4efb583bc574234012c04262cf0d0783d23fad00baee7a10b9e2f458ad162319d

Download Submit
memory/3376-2-0x0000021A00000000-0x0000021A00270000-memory.dmp

Filesize
2.4MB

Download
memory/3376-12-0x0000021A7AED0000-0x0000021A7AED1000-memory.dmp

Filesize
4KB

Download
memory/3376-13-0x0000021A00000000-0x0000021A00270000-memory.dmp

Filesize
2.4MB

Download