01b6b1fef127398f9aae43f9dabc1cf8ddf5a4e50981347a6f26b4c9d6291b54 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 07:42

Sharing

Report Analysis Logs

General

Target

bin/reset-pw.bat
Size

267B
MD5

e4922d1f584b9b4bc3a8a1941bdf97ca
SHA1

cf93a0aba5c46581f33950f2124c4e98c7b939f9
SHA256

124b8a9718908fff4b65bf64dec76ee2acf9d4b5235d8e0c945dbd1754c55861
SHA512

ca632bd3790cd6325b3112553f83e4af555d00e8b8aad2473cd59e736b441707dea404a87163ece908d502591e02252804894f712537654562ec002fcdf1414b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1548	1736	cmd.exe	29
PID 1736 wrote to memory of 1548	1736	cmd.exe	29
PID 1736 wrote to memory of 1548	1736	cmd.exe	29
PID 1548 wrote to memory of 2628	1548	java.exe	30
PID 1548 wrote to memory of 2628	1548	java.exe	30
PID 1548 wrote to memory of 2628	1548	java.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bin\reset-pw.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin reset_pw
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\system32\hostname.exe
    hostname
    3⤵
    PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-2-0x0000000002720000-0x0000000002990000-memory.dmp

Filesize
2.4MB

Download
memory/1548-15-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1548-16-0x0000000002720000-0x0000000002990000-memory.dmp

Filesize
2.4MB

Download