01b6b1fef127398f9aae43f9dabc1cf8ddf5a4e50981347a6f26b4c9d6291b54 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 07:42

Sharing

Report Analysis Logs

General

Target

bin/reset-acl.bat
Size

268B
MD5

d7698781da241057f3fc203363bfd111
SHA1

7e23cb9786be6ed7bfa1febb5609505f7b045805
SHA256

a11532199ea1196a148f394db97ee8ade0443543cad8081879b2826e1c0aa99a
SHA512

05be880649b6e7f6743bae35dd08e75b851ed13c200269cd41f70fbcbbce33794fef41fd0f9e08828ff448934f02bdd6c833534bee92d121f7960b2b30b85481

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2096	1232	cmd.exe	29
PID 1232 wrote to memory of 2096	1232	cmd.exe	29
PID 1232 wrote to memory of 2096	1232	cmd.exe	29
PID 2096 wrote to memory of 2652	2096	java.exe	30
PID 2096 wrote to memory of 2652	2096	java.exe	30
PID 2096 wrote to memory of 2652	2096	java.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bin\reset-acl.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\system32\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin reset_acl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\hostname.exe
    hostname
    3⤵
    PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-2-0x0000000002650000-0x00000000028C0000-memory.dmp

Filesize
2.4MB

Download
memory/2096-15-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2096-16-0x0000000002650000-0x00000000028C0000-memory.dmp

Filesize
2.4MB

Download