Analysis
-
max time kernel
100s -
max time network
29s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-01-2021 17:57
Static task
static1
Behavioral task
behavioral1
Sample
b59e14046324524903d77687b3477d04.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
b59e14046324524903d77687b3477d04.exe
-
Size
6.5MB
-
MD5
b59e14046324524903d77687b3477d04
-
SHA1
8596c6b591cfee14ee3dfd1abccc9c1cbacb1df5
-
SHA256
99e3d7fbbc0313a026f831c5304f4eee5b022e646416d8347d547ada3addb21f
-
SHA512
a8a8cc7640207fc628d92b9ee21c1536c19d277a81c4c4925966efff1e52f6c76798f056871266f9c2243d9fdd3b86c435645801e1834324e1c760e48e31e103
Malware Config
Signatures
-
XMRig Miner Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1044-2-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig behavioral1/memory/1044-4-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig behavioral1/memory/1044-5-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig behavioral1/memory/1044-6-0x0000000000400000-0x00000000010B6000-memory.dmp xmrig -
Processes:
yara_rule upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx upx -
Drops desktop.ini file(s) 2 IoCs
Processes:
b59e14046324524903d77687b3477d04.exedescription ioc process File created C:\$Recycle.Bin\S-1-5-21-293278959-2699126792-324916226-1000\desktop.ini b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini b59e14046324524903d77687b3477d04.exe -
Drops file in Program Files directory 151 IoCs
Processes:
b59e14046324524903d77687b3477d04.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\gu.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\7zG.exe b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\History.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\7z.dll b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\License.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt b59e14046324524903d77687b3477d04.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL b59e14046324524903d77687b3477d04.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg b59e14046324524903d77687b3477d04.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
b59e14046324524903d77687b3477d04.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.VhHXAXVNLq.com" b59e14046324524903d77687b3477d04.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
taskmgr.exepid process 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 484 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
b59e14046324524903d77687b3477d04.exetaskmgr.exedescription pid process Token: SeLockMemoryPrivilege 1044 b59e14046324524903d77687b3477d04.exe Token: SeLockMemoryPrivilege 1044 b59e14046324524903d77687b3477d04.exe Token: SeDebugPrivilege 484 taskmgr.exe -
Suspicious use of FindShellTrayWindow 82 IoCs
Processes:
taskmgr.exepid process 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe -
Suspicious use of SendNotifyMessage 82 IoCs
Processes:
taskmgr.exepid process 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe 484 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b59e14046324524903d77687b3477d04.exe"C:\Users\Admin\AppData\Local\Temp\b59e14046324524903d77687b3477d04.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/484-7-0x000007FEFB851000-0x000007FEFB853000-memory.dmpFilesize
8KB
-
memory/484-8-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1044-2-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/1044-3-0x00000000002E0000-0x00000000002F0000-memory.dmpFilesize
64KB
-
memory/1044-4-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/1044-5-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB
-
memory/1044-6-0x0000000000400000-0x00000000010B6000-memory.dmpFilesize
12.7MB