01b6b1fef127398f9aae43f9dabc1cf8ddf5a4e50981347a6f26b4c9d6291b54

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/reset-pw.bat
Size

267B
MD5

e4922d1f584b9b4bc3a8a1941bdf97ca
SHA1

cf93a0aba5c46581f33950f2124c4e98c7b939f9
SHA256

124b8a9718908fff4b65bf64dec76ee2acf9d4b5235d8e0c945dbd1754c55861
SHA512

ca632bd3790cd6325b3112553f83e4af555d00e8b8aad2473cd59e736b441707dea404a87163ece908d502591e02252804894f712537654562ec002fcdf1414b

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4332	icacls.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 2172	4208	cmd.exe	83
PID 4208 wrote to memory of 2172	4208	cmd.exe	83
PID 2172 wrote to memory of 4332	2172	java.exe	84
PID 2172 wrote to memory of 4332	2172	java.exe	84
PID 2172 wrote to memory of 512	2172	java.exe	86
PID 2172 wrote to memory of 512	2172	java.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bin\reset-pw.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin reset_pw
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:4332
- - C:\Windows\SYSTEM32\hostname.exe
    hostname
    3⤵
    PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
17dd46a97de27ed5f80691fee69c3ddb

SHA1
a1fb9c55598747bceb9bf98b5414726c5cec4f45

SHA256
4b371c3e6c44b06c051ede6bade3944c5263c5ac9d8901457a1ea97d7ebee0c7

SHA512
64774f4a257c70566db0d06114acacda5aa8e7d09384aabfff327752d8e878fd6b495761a151dca2fd26e81daf39ff18e7f52ea5f8cc4a7cccbe4c945a01f924

Download Submit
memory/2172-2-0x0000027EB6870000-0x0000027EB6AE0000-memory.dmp

Filesize
2.4MB

Download
memory/2172-16-0x0000027EB4FC0000-0x0000027EB4FC1000-memory.dmp

Filesize
4KB

Download
memory/2172-18-0x0000027EB4FC0000-0x0000027EB4FC1000-memory.dmp

Filesize
4KB

Download
memory/2172-19-0x0000027EB6870000-0x0000027EB6AE0000-memory.dmp

Filesize
2.4MB

Download