8ebd1b8741900582b4c72acf34988c2817d62a0756a4a21875c68dfe8714e482 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 07:28

Sharing

Report Analysis Logs

General

Target

bin/shutdown.bat
Size

265B
MD5

ce9f268c1bbdeaac25d2e57d031b702f
SHA1

61c36889463c8ad334e610c9f806483097fea4fd
SHA256

71c0ff0cb2f9fd3ec0e6a65eb242f6b499c9832ceb3f403f0f5f680a02f882aa
SHA512

daf7d6c9e8f264824cb05ca51ea78a89c7d781ae757e0b2b1704107bca07bb6fca2145f555993a612c71f2c19e02d8fe7b9bfe2122c7a1a3c96ed85998703e9e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2588	2156	cmd.exe	29
PID 2156 wrote to memory of 2588	2156	cmd.exe	29
PID 2156 wrote to memory of 2588	2156	cmd.exe	29
PID 2588 wrote to memory of 2620	2588	java.exe	30
PID 2588 wrote to memory of 2620	2588	java.exe	30
PID 2588 wrote to memory of 2620	2588	java.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bin\shutdown.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin shutdown
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\hostname.exe
    hostname
    3⤵
    PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2588-2-0x0000000002650000-0x00000000028C0000-memory.dmp

Filesize
2.4MB

Download
memory/2588-15-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2588-16-0x0000000002650000-0x00000000028C0000-memory.dmp

Filesize
2.4MB

Download