01b6b1fef127398f9aae43f9dabc1cf8ddf5a4e50981347a6f26b4c9d6291b54

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/reset-acl.bat
Size

268B
MD5

d7698781da241057f3fc203363bfd111
SHA1

7e23cb9786be6ed7bfa1febb5609505f7b045805
SHA256

a11532199ea1196a148f394db97ee8ade0443543cad8081879b2826e1c0aa99a
SHA512

05be880649b6e7f6743bae35dd08e75b851ed13c200269cd41f70fbcbbce33794fef41fd0f9e08828ff448934f02bdd6c833534bee92d121f7960b2b30b85481

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4652	icacls.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4108	2928	cmd.exe	91
PID 2928 wrote to memory of 4108	2928	cmd.exe	91
PID 4108 wrote to memory of 4652	4108	java.exe	92
PID 4108 wrote to memory of 4652	4108	java.exe	92
PID 4108 wrote to memory of 4752	4108	java.exe	94
PID 4108 wrote to memory of 4752	4108	java.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bin\reset-acl.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin reset_acl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:4652
- - C:\Windows\SYSTEM32\hostname.exe
    hostname
    3⤵
    PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4440,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
93730bd60047d57f4576402d97e456cf

SHA1
086addd1c2c8fb84affd5cda4031c2b81fcec719

SHA256
e207f1a7147f2e41f1efcf6b5b41d858272ce6adab0a43665a9844c74a7a2b17

SHA512
d1be6d7107543029120f41712697f966e28aa519d4ad2e6e345ab0516fe3bac2f8bfc13fcdcca53e9eeb1a38df7f405565593af784978a859838387d62109b8e

Download Submit
memory/4108-2-0x0000016C1D9F0000-0x0000016C1DC60000-memory.dmp

Filesize
2.4MB

Download
memory/4108-16-0x0000016C1D9D0000-0x0000016C1D9D1000-memory.dmp

Filesize
4KB

Download
memory/4108-18-0x0000016C1D9D0000-0x0000016C1D9D1000-memory.dmp

Filesize
4KB

Download
memory/4108-19-0x0000016C1D9F0000-0x0000016C1DC60000-memory.dmp

Filesize
2.4MB

Download