Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 12:59
General
-
Target
a8f2b434dddca07d7e6961d8f3397d9b4fc229411bf5c6cf456db0b12cc1f81b.exe
-
Size
517KB
-
MD5
0d0d474a1e1a09a0d9d5e8f375438475
-
SHA1
6e7ddc644600681ea16847191d2fe2b16375f0a7
-
SHA256
a8f2b434dddca07d7e6961d8f3397d9b4fc229411bf5c6cf456db0b12cc1f81b
-
SHA512
3d3a0017253463cd45a1d38a28e02276f72a8d2cf073a7b49c40251ed63e59f3e56efbe7becf3b623f8d4b24d3047aa8dc536b95937a1a6ef044fe771863402a
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 22 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\a8f2b434dddca07d7e6961d8f3397d9b4fc229411bf5c6cf456db0b12cc1f81b.exe"C:\Users\Admin\AppData\Local\Temp\a8f2b434dddca07d7e6961d8f3397d9b4fc229411bf5c6cf456db0b12cc1f81b.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\icactall\Settance.exe"C:\Users\Admin\AppData\Roaming\icactall\Settance.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~7341.tmp"C:\Users\Admin\AppData\Local\Temp\~7341.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\~73ED.tmp.xlsx"3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\Cameutil.exeC:\Windows\SysWOW64\Cameutil.exe -k1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
b1fb7a3de4afff73216bdd998f99003c
SHA1c4d80769e0df37096c7372f4bbe4d5643d18bf6a
SHA256c88c50804998eb2446eeacc1e148fce48c8880071a61dd006dbebd9ff0016f41
SHA51295ee28e64faba3694c1d3a7e537378e696f1e2b8013c0ecf5aea74b1b94be29c3f17391a1dbdbe65b86aa3e7ec8be13df73986872ba1c34a378c14c8b92b565a
-
MD5
b1fb7a3de4afff73216bdd998f99003c
SHA1c4d80769e0df37096c7372f4bbe4d5643d18bf6a
SHA256c88c50804998eb2446eeacc1e148fce48c8880071a61dd006dbebd9ff0016f41
SHA51295ee28e64faba3694c1d3a7e537378e696f1e2b8013c0ecf5aea74b1b94be29c3f17391a1dbdbe65b86aa3e7ec8be13df73986872ba1c34a378c14c8b92b565a
-
MD5
c7c71ed0e92671007caa33cf38a93439
SHA1ac7fd84c13f7c9b2121b95444bd033501c760e83
SHA2566692da61467de18bf234cfe1bb3424fee30156b71a23897b3c19661ab812645b
SHA5126bfeee0f678a602d8929134b0ff8e42d2ffc475ab5820ab3c2c13dd941c65d82c97d842c7cf5f0a3b8cc6295a973d8a1e0ca6848caff19143ae09b2307f1b9ac
-
MD5
4fcb2a3ee025e4a10d21e1b154873fe2
SHA157658e2fa594b7d0b99d02e041d0f3418e58856b
SHA25690bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
SHA5124e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
-
MD5
e1cf05b9dad3984890aed73911c1ca32
SHA1cd1242b19282696200e07a16aff1665f715e6e0b
SHA2569a4a6a3daedf42230936fccedddf13881001cee966bf3931016958455fd9ea4e
SHA5127a5f3ff97eb0866d5b192d9d13e8c025ac916bd4bec60bb5c3e61adf3317fbd41c5c1c3a5741544e3c56bb2051a6b632347bbe6374ac0a42c0d7e35e502991ac
-
MD5
e1cf05b9dad3984890aed73911c1ca32
SHA1cd1242b19282696200e07a16aff1665f715e6e0b
SHA2569a4a6a3daedf42230936fccedddf13881001cee966bf3931016958455fd9ea4e
SHA5127a5f3ff97eb0866d5b192d9d13e8c025ac916bd4bec60bb5c3e61adf3317fbd41c5c1c3a5741544e3c56bb2051a6b632347bbe6374ac0a42c0d7e35e502991ac
-
MD5
0d0d474a1e1a09a0d9d5e8f375438475
SHA16e7ddc644600681ea16847191d2fe2b16375f0a7
SHA256a8f2b434dddca07d7e6961d8f3397d9b4fc229411bf5c6cf456db0b12cc1f81b
SHA5123d3a0017253463cd45a1d38a28e02276f72a8d2cf073a7b49c40251ed63e59f3e56efbe7becf3b623f8d4b24d3047aa8dc536b95937a1a6ef044fe771863402a
-
MD5
0d0d474a1e1a09a0d9d5e8f375438475
SHA16e7ddc644600681ea16847191d2fe2b16375f0a7
SHA256a8f2b434dddca07d7e6961d8f3397d9b4fc229411bf5c6cf456db0b12cc1f81b
SHA5123d3a0017253463cd45a1d38a28e02276f72a8d2cf073a7b49c40251ed63e59f3e56efbe7becf3b623f8d4b24d3047aa8dc536b95937a1a6ef044fe771863402a
-
-
Filesize
596KB
-
Filesize
696KB
-
Filesize
64KB
-
-
Filesize
53.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16.9MB
-
Filesize
31.0MB
-
Filesize
1.3MB
-
-
Filesize
268KB