Analysis
-
max time kernel
25s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2023 18:47
Behavioral task
behavioral1
Sample
xmrig.exe
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
xmrig.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
xmrig.exe
-
Size
7.8MB
-
MD5
6f4532e49d65c2be0355b222f96e06e8
-
SHA1
268e90ce25e01bbb205f6ae3f493f8da36a61480
-
SHA256
acaf8e844ef7f4f65033ebe9546c394cc21bce175dac8b59199106309f04e5ab
-
SHA512
85f495b0bbd0673df376f44e912f9a0a8d201c2843f1a9efa64d93703a2d8ba2b6fa2638a747e79604715d26ddfc07de26ba43d03adf86290d928b442bf09207
-
SSDEEP
98304:D8sOUckgBwr4UyuwShsa+XbcDVa2+N/qyRiXM71ZQkcn4CuJ9KWZVxBJNxg/F5MB:vYwr/xU3rDXWMc85j4eEsoCSCwG
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2944 taskmgr.exe Token: SeSystemProfilePrivilege 2944 taskmgr.exe Token: SeCreateGlobalPrivilege 2944 taskmgr.exe Token: 33 2944 taskmgr.exe Token: SeIncBasePriorityPrivilege 2944 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\xmrig.exe"1⤵PID:3104
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2944