Analysis
-
max time kernel
131s -
max time network
225s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
08-12-2021 08:15
General
-
Target
software.exe
-
Size
3.2MB
-
MD5
9bb9bef710583acc0b74b42e9c244209
-
SHA1
ac0cb5474c2bd21263c3758aaff6420f7380f5b6
-
SHA256
15fea1662d7a85e4d95fd89e36b4f02dd6657045ea9f20301130a321994504c6
-
SHA512
aa630dec6a967b9bbbad8425ac8afee443f7e37dbf21fe761fd3a4a27f3b78efdd92b13fd14a3e8931045d803ec52f7b1276f6534bf6b07e8ab1a4e74340ae17
Malware Config
Extracted
C:\Decryption-Guide.txt
wixawm@gmail.com
Extracted
C:\Users\Admin\Desktop\Decryption-Guide.HTA
Email:wixawm@gmail.com
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Drops file in Drivers directory 27 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
-
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
NTFS ADS 3 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\software.exe"C:\Users\Admin\AppData\Local\Temp\software.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop vds3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO12⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO13⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO14⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5801⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Decryption-Guide.txt1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\Decryption-Guide.HTA"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Decryption-Guide.txtMD5
ec58d88f5be905c3a2ad080bbc9b3654
SHA19ab22988d5c0278b9142f8439f01723a3ef69adf
SHA2566c8927f4f4bb5df869b51b28a7fe34434e3dda5dc19a44c0cbcca996b856f9fe
SHA512f837d90133cba89e5d98d06e263a91aef849062f281c13aa695f4d13cc21381509f743768daebe5300c3333cb3701f688f92095310d3365e64d0b25458a8cf6c
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\Decryption-Guide.HTAMD5
875a5bc311a517ac8dfb6650a4fb3bf8
SHA1b303f4b41837495d3825ed9deedcd33b639dbb95
SHA256f75e01cc847e8ec9ed652bed393cc5ac34c4220ef1607c862048dd630e30499a
SHA5120bec10bc0ad30215666c01656fb666a071525f902766257d9ccb95a4408140a75d27b61c11c6f32b7ec7abe935708ee2deb5495f34d27c7c165f3294f3f36350
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\Decryption-Guide.txtMD5
ec58d88f5be905c3a2ad080bbc9b3654
SHA19ab22988d5c0278b9142f8439f01723a3ef69adf
SHA2566c8927f4f4bb5df869b51b28a7fe34434e3dda5dc19a44c0cbcca996b856f9fe
SHA512f837d90133cba89e5d98d06e263a91aef849062f281c13aa695f4d13cc21381509f743768daebe5300c3333cb3701f688f92095310d3365e64d0b25458a8cf6c
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\Decryption-Guide.HTAMD5
875a5bc311a517ac8dfb6650a4fb3bf8
SHA1b303f4b41837495d3825ed9deedcd33b639dbb95
SHA256f75e01cc847e8ec9ed652bed393cc5ac34c4220ef1607c862048dd630e30499a
SHA5120bec10bc0ad30215666c01656fb666a071525f902766257d9ccb95a4408140a75d27b61c11c6f32b7ec7abe935708ee2deb5495f34d27c7c165f3294f3f36350
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\Decryption-Guide.txtMD5
ec58d88f5be905c3a2ad080bbc9b3654
SHA19ab22988d5c0278b9142f8439f01723a3ef69adf
SHA2566c8927f4f4bb5df869b51b28a7fe34434e3dda5dc19a44c0cbcca996b856f9fe
SHA512f837d90133cba89e5d98d06e263a91aef849062f281c13aa695f4d13cc21381509f743768daebe5300c3333cb3701f688f92095310d3365e64d0b25458a8cf6c
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\Decryption-Guide.HTAMD5
875a5bc311a517ac8dfb6650a4fb3bf8
SHA1b303f4b41837495d3825ed9deedcd33b639dbb95
SHA256f75e01cc847e8ec9ed652bed393cc5ac34c4220ef1607c862048dd630e30499a
SHA5120bec10bc0ad30215666c01656fb666a071525f902766257d9ccb95a4408140a75d27b61c11c6f32b7ec7abe935708ee2deb5495f34d27c7c165f3294f3f36350
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\Decryption-Guide.txtMD5
ec58d88f5be905c3a2ad080bbc9b3654
SHA19ab22988d5c0278b9142f8439f01723a3ef69adf
SHA2566c8927f4f4bb5df869b51b28a7fe34434e3dda5dc19a44c0cbcca996b856f9fe
SHA512f837d90133cba89e5d98d06e263a91aef849062f281c13aa695f4d13cc21381509f743768daebe5300c3333cb3701f688f92095310d3365e64d0b25458a8cf6c
-
C:\Users\Admin\Desktop\Decryption-Guide.HTAMD5
875a5bc311a517ac8dfb6650a4fb3bf8
SHA1b303f4b41837495d3825ed9deedcd33b639dbb95
SHA256f75e01cc847e8ec9ed652bed393cc5ac34c4220ef1607c862048dd630e30499a
SHA5120bec10bc0ad30215666c01656fb666a071525f902766257d9ccb95a4408140a75d27b61c11c6f32b7ec7abe935708ee2deb5495f34d27c7c165f3294f3f36350
-
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dllMD5
7b2a54732d38cd19c79c8184d6932f6f
SHA16d42bd8fe510e9a4ed6c13409daf4c7a49e7db04
SHA25676fc819738acfc13818287353b2ee4c5e881d5418e7b6e20c2be03521a2b755d
SHA512acde084716a0d9da1c0834c8bc683b98721bba6b32c843eee1010779bf51cdc9d4ff3de7a4e35ee8053f70afd7705428d4404ceaf10d597ea8e6e95be2bff0c0
-
memory/364-59-0x0000000000000000-mapping.dmp
-
memory/364-86-0x0000000000000000-mapping.dmp
-
memory/432-87-0x0000000000000000-mapping.dmp
-
memory/476-73-0x0000000000000000-mapping.dmp
-
memory/548-83-0x0000000000000000-mapping.dmp
-
memory/560-57-0x0000000000000000-mapping.dmp
-
memory/568-58-0x0000000000000000-mapping.dmp
-
memory/568-85-0x0000000000000000-mapping.dmp
-
memory/588-55-0x0000000000000000-mapping.dmp
-
memory/636-56-0x0000000000000000-mapping.dmp
-
memory/768-81-0x0000000000000000-mapping.dmp
-
memory/868-74-0x0000000000000000-mapping.dmp
-
memory/976-61-0x0000000000000000-mapping.dmp
-
memory/1052-60-0x0000000000000000-mapping.dmp
-
memory/1088-65-0x0000000000000000-mapping.dmp
-
memory/1116-64-0x0000000000000000-mapping.dmp
-
memory/1216-82-0x0000000000000000-mapping.dmp
-
memory/1412-89-0x000007FEFC061000-0x000007FEFC063000-memory.dmpFilesize
8KB
-
memory/1488-77-0x0000000000000000-mapping.dmp
-
memory/1552-67-0x0000000000000000-mapping.dmp
-
memory/1580-62-0x0000000000000000-mapping.dmp
-
memory/1616-76-0x0000000000000000-mapping.dmp
-
memory/1628-80-0x0000000000000000-mapping.dmp
-
memory/1692-79-0x0000000000000000-mapping.dmp
-
memory/1760-70-0x0000000000000000-mapping.dmp
-
memory/1804-63-0x0000000000000000-mapping.dmp
-
memory/1828-68-0x0000000000000000-mapping.dmp
-
memory/1928-69-0x0000000000000000-mapping.dmp
-
memory/1960-84-0x0000000000000000-mapping.dmp
-
memory/1968-78-0x0000000000000000-mapping.dmp
-
memory/1980-71-0x0000000000000000-mapping.dmp
-
memory/1980-72-0x0000000076081000-0x0000000076083000-memory.dmpFilesize
8KB
-
memory/2036-66-0x0000000000000000-mapping.dmp