Analysis
-
max time kernel
150s -
max time network
80s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 04:15
General
-
Target
39a8becef66ccb3da484d4086b7c477d6d7a719055facef105ad8bed55764636.exe
-
Size
428KB
-
MD5
1b851741db97887f9c1232602b462a90
-
SHA1
1523dff727c1bb11f1b16a45b6fe4a8334eaaab5
-
SHA256
39a8becef66ccb3da484d4086b7c477d6d7a719055facef105ad8bed55764636
-
SHA512
6a71699dda1b3bd4f6d02ce4fcd88a7998ec2d301cb844ab74caa5a4ae446e7d953c97f5e75673630dccebbd4e7bffb10fa75083f45cc01630b389fea4b37a97
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 3 IoCs
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\39a8becef66ccb3da484d4086b7c477d6d7a719055facef105ad8bed55764636.exe"C:\Users\Admin\AppData\Local\Temp\39a8becef66ccb3da484d4086b7c477d6d7a719055facef105ad8bed55764636.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Instexer\calcst3g.exe"C:\Users\Admin\AppData\Roaming\Instexer\calcst3g.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\~8FD2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\~904F.tmp.ppt" /ou ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\sorttion.exeC:\Windows\SysWOW64\sorttion.exe -k1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
fa3f39dcfd197e2143a4ec2a98fbbb99
SHA1eb17051dc2f15738706f5c2707656542acb5bafb
SHA2567875cab39968692339733d3dac65b61490c1f99a1cf72eceeff22969ab2f796a
SHA5120000f251a81f839122875829bc270e06e18cce5e1facb9743294509985b23a6c12d480955bd97d82f89acc97c252f9b3efa8cf24cf8d22766a15b6d043d81877
-
MD5
fa3f39dcfd197e2143a4ec2a98fbbb99
SHA1eb17051dc2f15738706f5c2707656542acb5bafb
SHA2567875cab39968692339733d3dac65b61490c1f99a1cf72eceeff22969ab2f796a
SHA5120000f251a81f839122875829bc270e06e18cce5e1facb9743294509985b23a6c12d480955bd97d82f89acc97c252f9b3efa8cf24cf8d22766a15b6d043d81877
-
MD5
942f827c62fa92a31c777537bb38cf05
SHA1be180a3e288dde356faebbc1e538596d77542e6d
SHA256156f81df474e8dbfd97470edaff05d1cf2cf416ed1473bc7c79ef16c8b51a25e
SHA51218145a4f0641244a005a328a6180eaaa44f799fca3d6edfeba58ce3940af7d72640a41822e2b59134bd27972cc3a6f7ca66edefdb128a41625e538a72cff3989
-
MD5
e225d37c3248dcc6e6c8095133edb86d
SHA1b8c6f0854b3de52741a6203a3c644f7fd8827629
SHA2564d9d606d4906538644c87c6425ff8607b08425674e600e8836279b917269285f
SHA51243ca896a4f7014ec40a0ca1b55507a7611d7af1f15153fe7cb09549a0fcefaf35d0edf3e90ca5ec99d6fd2433e3134550825fff1572da7ad2625ae9c0ab4d111
-
MD5
e225d37c3248dcc6e6c8095133edb86d
SHA1b8c6f0854b3de52741a6203a3c644f7fd8827629
SHA2564d9d606d4906538644c87c6425ff8607b08425674e600e8836279b917269285f
SHA51243ca896a4f7014ec40a0ca1b55507a7611d7af1f15153fe7cb09549a0fcefaf35d0edf3e90ca5ec99d6fd2433e3134550825fff1572da7ad2625ae9c0ab4d111
-
MD5
1b851741db97887f9c1232602b462a90
SHA11523dff727c1bb11f1b16a45b6fe4a8334eaaab5
SHA25639a8becef66ccb3da484d4086b7c477d6d7a719055facef105ad8bed55764636
SHA5126a71699dda1b3bd4f6d02ce4fcd88a7998ec2d301cb844ab74caa5a4ae446e7d953c97f5e75673630dccebbd4e7bffb10fa75083f45cc01630b389fea4b37a97
-
MD5
1b851741db97887f9c1232602b462a90
SHA11523dff727c1bb11f1b16a45b6fe4a8334eaaab5
SHA25639a8becef66ccb3da484d4086b7c477d6d7a719055facef105ad8bed55764636
SHA5126a71699dda1b3bd4f6d02ce4fcd88a7998ec2d301cb844ab74caa5a4ae446e7d953c97f5e75673630dccebbd4e7bffb10fa75083f45cc01630b389fea4b37a97
-
-
Filesize
508KB
-
Filesize
1.3MB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
27.9MB
-
Filesize
16.9MB
-
Filesize
31.0MB
-
Filesize
1.3MB
-
-
Filesize
268KB