Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 06:47
General
-
Target
72e78026a689d2c19d4f8b114826b848dbd7b9a3e61b2b67bdb67e251f4312ed.exe
-
Size
507KB
-
MD5
23b72853593ab99c7b8e48fcd808d4e4
-
SHA1
b3384c345f9732bf33827c037af3c0bc7bc94ebb
-
SHA256
72e78026a689d2c19d4f8b114826b848dbd7b9a3e61b2b67bdb67e251f4312ed
-
SHA512
eb5e6fa0b5251cfdea345aa64c77b44779fda40299822aa78333ddc8d1dfef0ba78937f3785847869fba68627f938117a04155d3b54842f16d5100ab58b7f10b
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 3 IoCs
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\72e78026a689d2c19d4f8b114826b848dbd7b9a3e61b2b67bdb67e251f4312ed.exe"C:\Users\Admin\AppData\Local\Temp\72e78026a689d2c19d4f8b114826b848dbd7b9a3e61b2b67bdb67e251f4312ed.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\msrareg\NETSll32.exe"C:\Users\Admin\AppData\Roaming\msrareg\NETSll32.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~96C7.tmp"C:\Users\Admin\AppData\Local\Temp\~96C7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\~9744.tmp.ppt" /ou ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DpiS.exeC:\Windows\SysWOW64\DpiS.exe -k1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
cb63ac125df50bfd7f600a2c108104d7
SHA14f8b4c598ba11f1a27a0851750be7393bab2f644
SHA256c5da0d968378ccab34b3b397de2344e3469e98251d86190e956e28a84088883f
SHA512cbc28501191b2448b88f1be21874535b8210ffe42324aa508054c5b67389a05dde19acbcf08e4ad80cba77e94ab707a884b77e1f51ccf9ea05a99c52e1b804a3
-
MD5
cb63ac125df50bfd7f600a2c108104d7
SHA14f8b4c598ba11f1a27a0851750be7393bab2f644
SHA256c5da0d968378ccab34b3b397de2344e3469e98251d86190e956e28a84088883f
SHA512cbc28501191b2448b88f1be21874535b8210ffe42324aa508054c5b67389a05dde19acbcf08e4ad80cba77e94ab707a884b77e1f51ccf9ea05a99c52e1b804a3
-
MD5
d24994bb034778c95e54c8d22ebb08e2
SHA16fe25ec8d3c34a081a6eda7286f14208c1d9d834
SHA25672fb2cf9df19f135875c1eac6a9b70709aff2055c213676e88e6a32da3d52dc1
SHA512ce9bc85e91529feb3c322172257199b2edf8e474e5101107b0f13b9e08cc29a548a086b56958c099c43e4703efea95c02d0d3dcd6cc07749ddc4d6c9862de375
-
MD5
a5230082328e85db5f7bfcdabe5c7887
SHA1ee3422e59fe2f951ce911332951449f3f11aa5c8
SHA256e8bf296976a130329883f5f65a8c7af7c0b853a7be8792ba1c8c8dd87c173b30
SHA5121f0ea6407fee4a1844e617eedb319b098d4ada554db9b6c7e1dd87ae6ad4a3018a22421c77b085f426fc90691d5d208bc6bf22e98291cf273c31043b21b384a7
-
MD5
a5230082328e85db5f7bfcdabe5c7887
SHA1ee3422e59fe2f951ce911332951449f3f11aa5c8
SHA256e8bf296976a130329883f5f65a8c7af7c0b853a7be8792ba1c8c8dd87c173b30
SHA5121f0ea6407fee4a1844e617eedb319b098d4ada554db9b6c7e1dd87ae6ad4a3018a22421c77b085f426fc90691d5d208bc6bf22e98291cf273c31043b21b384a7
-
MD5
23b72853593ab99c7b8e48fcd808d4e4
SHA1b3384c345f9732bf33827c037af3c0bc7bc94ebb
SHA25672e78026a689d2c19d4f8b114826b848dbd7b9a3e61b2b67bdb67e251f4312ed
SHA512eb5e6fa0b5251cfdea345aa64c77b44779fda40299822aa78333ddc8d1dfef0ba78937f3785847869fba68627f938117a04155d3b54842f16d5100ab58b7f10b
-
MD5
23b72853593ab99c7b8e48fcd808d4e4
SHA1b3384c345f9732bf33827c037af3c0bc7bc94ebb
SHA25672e78026a689d2c19d4f8b114826b848dbd7b9a3e61b2b67bdb67e251f4312ed
SHA512eb5e6fa0b5251cfdea345aa64c77b44779fda40299822aa78333ddc8d1dfef0ba78937f3785847869fba68627f938117a04155d3b54842f16d5100ab58b7f10b
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
27.9MB
-
Filesize
31.0MB
-
Filesize
16.9MB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
256KB
-
-
Filesize
1.3MB
-
-
Filesize
268KB