Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28-09-2022 16:23
General
-
Target
956117586181a15056ff4420076301c3.exe
-
Size
3.4MB
-
MD5
956117586181a15056ff4420076301c3
-
SHA1
e8ec0f2435bfbb699d944ad86a634c33d509107c
-
SHA256
e038d93033cc8788027ff5c045b6bd2beab9b34ef79b80e61d6d1c587bd86e16
-
SHA512
8d299ecc49741ec341e34459ae5e4b6472e190c994a47ba3cdd29d309a169baf54f12451675d1af22fc38c0aed6037d7861e8d9cf60dc664e75981ccbfcfdf35
-
SSDEEP
98304:ch0ywRz70/W9+68ZBtKe3oWFGNc+sA5loQwMEp+ou/HJ:3yf/W9+DfFGNv5lnEMoOJ
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 52 IoCs
-
Suspicious use of FindShellTrayWindow 63 IoCs
-
Suspicious use of SendNotifyMessage 63 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\956117586181a15056ff4420076301c3.exe"C:\Users\Admin\AppData\Local\Temp\956117586181a15056ff4420076301c3.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe ilomnyjxaqxbdyoj 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUOWlLosYbrY2pwtQQU1JTuikNmZuGmV+6BbKlyKFD6zdAaaNcQqky2iJHSWRIHnss9X/nab3QoNVM/Ta0kPMjvUxJH02YjP5XrdviLouahJX3Q1zD8omsKRft5FC/3aHRX5nzuLKj6v+l1hD7RDcnRlZOinraqnGRmc1rfZVBSryXdWQXUdRaex46bFg0DdbEVFMZ4l0pshLxALGam+crSqgmoA+SAgVTiLqPU5NWi5uz8p9/Px4ZVwH3rGiyQeauAdOPHdWjMSLjdPXQwzIiHwOAjFFE5CqTkW9rgSKBlevE7bTasEexce14S+TdxAbNPSrsW2DMq8LcazEG7sh428X1gT4o5W2jpf5fY/EMDWCsJla29dmLn/CAr49BWQFG1/pwNMU6xh2tqJf8WnFCSEU3eXDu2G8zQ9IwK7MpQkB1D9krTLyt7WoPvOZQOh0lkfSckQ6jxQVRjaMclifx2Mi/zUH96ZVLzydQh6xfv78=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
memory/1576-135-0x0000000000000000-mapping.dmp
-
memory/2264-133-0x0000000000000000-mapping.dmp
-
memory/2888-136-0x0000000000000000-mapping.dmp
-
memory/3724-132-0x0000000000000000-mapping.dmp
-
memory/4224-134-0x0000000000000000-mapping.dmp
-
memory/4992-140-0x00007FF693910000-0x00007FF694104000-memory.dmpFilesize
8.0MB
-
memory/4992-139-0x000002C520A10000-0x000002C520A30000-memory.dmpFilesize
128KB
-
memory/4992-138-0x00007FF694102120-mapping.dmp
-
memory/4992-141-0x000002C520A50000-0x000002C520A90000-memory.dmpFilesize
256KB
-
memory/4992-142-0x00007FF693910000-0x00007FF694104000-memory.dmpFilesize
8.0MB
-
memory/4992-143-0x000002C520BE0000-0x000002C520C00000-memory.dmpFilesize
128KB
-
memory/4992-144-0x000002C520BE0000-0x000002C520C00000-memory.dmpFilesize
128KB
-
memory/4992-145-0x000002C520BE0000-0x000002C520C00000-memory.dmpFilesize
128KB
-
memory/4992-146-0x000002C520C20000-0x000002C520C40000-memory.dmpFilesize
128KB
-
memory/4992-147-0x000002C520BE0000-0x000002C520C00000-memory.dmpFilesize
128KB
-
memory/4992-148-0x000002C520C20000-0x000002C520C40000-memory.dmpFilesize
128KB