01b6b1fef127398f9aae43f9dabc1cf8ddf5a4e50981347a6f26b4c9d6291b54 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 07:42

Sharing

Report Analysis Logs

General

Target

bin/shutdown.bat
Size

265B
MD5

ce9f268c1bbdeaac25d2e57d031b702f
SHA1

61c36889463c8ad334e610c9f806483097fea4fd
SHA256

71c0ff0cb2f9fd3ec0e6a65eb242f6b499c9832ceb3f403f0f5f680a02f882aa
SHA512

daf7d6c9e8f264824cb05ca51ea78a89c7d781ae757e0b2b1704107bca07bb6fca2145f555993a612c71f2c19e02d8fe7b9bfe2122c7a1a3c96ed85998703e9e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3068	2996	cmd.exe	29
PID 2996 wrote to memory of 3068	2996	cmd.exe	29
PID 2996 wrote to memory of 3068	2996	cmd.exe	29
PID 3068 wrote to memory of 2672	3068	java.exe	30
PID 3068 wrote to memory of 2672	3068	java.exe	30
PID 3068 wrote to memory of 2672	3068	java.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bin\shutdown.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin shutdown
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\system32\hostname.exe
    hostname
    3⤵
    PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-2-0x0000000002690000-0x0000000002900000-memory.dmp

Filesize
2.4MB

Download
memory/3068-15-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/3068-16-0x0000000002690000-0x0000000002900000-memory.dmp

Filesize
2.4MB

Download