01b6b1fef127398f9aae43f9dabc1cf8ddf5a4e50981347a6f26b4c9d6291b54

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/ping.bat
Size

263B
MD5

62a26811014559b839c885cd2ac31fa7
SHA1

b3fe62360fa6229b9d9da820c545d6c9fce8c215
SHA256

e3154b30109f1cbd15de5a40e641105ab4b2d0f648abfc94c21fdb32ffc0fe6d
SHA512

3f9b5fd6b40aea56077a2b55da0ac246d598070e2c10b3ec0a211375b1eddbcc39dded18fc68d73dc1146f2d01f37a882187eb624f20f0c639221c0c4f8b9ed2

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4916	icacls.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4436	3032	cmd.exe	86
PID 3032 wrote to memory of 4436	3032	cmd.exe	86
PID 4436 wrote to memory of 4916	4436	java.exe	87
PID 4436 wrote to memory of 4916	4436	java.exe	87
PID 4436 wrote to memory of 3616	4436	java.exe	89
PID 4436 wrote to memory of 3616	4436	java.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bin\ping.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin ping
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:4916
- - C:\Windows\SYSTEM32\hostname.exe
    hostname
    3⤵
    PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
20482aaf8d3fc039a430c017ad91be85

SHA1
31c2e35f0c10430db06c2312a7cb39be87e6f18f

SHA256
936569157a97ad2f7ebbfcb53fbb9cfbb4da7054a71d44d5e5c04bceb4dffbcf

SHA512
6a547d4334470772dcf678dd93ba696a94e22471aa70b41d27233f3a7e7d54af2c35bae9ae18c381c5d51da4e72b87d8d2293b1ea36c20a1d2b6dc27e708c598

Download Submit
memory/4436-2-0x0000028401410000-0x0000028401680000-memory.dmp

Filesize
2.4MB

Download
memory/4436-16-0x000002847EF90000-0x000002847EF91000-memory.dmp

Filesize
4KB

Download
memory/4436-18-0x000002847EF90000-0x000002847EF91000-memory.dmp

Filesize
4KB

Download
memory/4436-19-0x0000028401410000-0x0000028401680000-memory.dmp

Filesize
2.4MB

Download