Analysis
-
max time kernel
1800s -
max time network
1798s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2023 11:34
Static task
static1
Behavioral task
behavioral1
Sample
test13.exe
Resource
win10-20230220-en
windows10-1703-x64
12 signatures
1800 seconds
Behavioral task
behavioral2
Sample
test13.exe
Resource
win7-20230220-en
windows7-x64
13 signatures
1800 seconds
General
-
Target
test13.exe
-
Size
5.6MB
-
MD5
dd6511650167bd50c8baf3c321d68cd7
-
SHA1
b7a0cf91f251935969e75628c080bf38f694e6c6
-
SHA256
add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
-
SHA512
da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c
-
SSDEEP
98304:tR4QavOFDCN/Li9/oDsBaSnEolKi8JBoazSzZMrq7g2FWO2kBcQf41/9UMbKTurd:tnaEDCNOp5EolKi8JTS2wg2FWO2kP41R
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
description pid Process procid_target PID 4512 created 916 4512 test13.exe 35 PID 4512 created 916 4512 test13.exe 35 PID 4512 created 916 4512 test13.exe 35 PID 4552 created 916 4552 updater.exe 35 PID 4552 created 916 4552 updater.exe 35 PID 4552 created 916 4552 updater.exe 35 PID 4552 created 916 4552 updater.exe 35 -
XMRig Miner payload 31 IoCs
resource yara_rule behavioral3/memory/4552-171-0x00007FF64E040000-0x00007FF64E5DA000-memory.dmp xmrig behavioral3/memory/1620-175-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-179-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-183-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-185-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-187-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-189-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-191-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-193-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-195-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-197-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-199-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-201-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-207-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-209-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-211-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-213-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-215-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-217-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-219-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-221-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-223-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-225-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-227-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-229-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-231-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-233-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-235-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-237-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-239-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig behavioral3/memory/1620-241-0x00007FF7A6C40000-0x00007FF7A742F000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
pid Process 4552 updater.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4552 set thread context of 3560 4552 updater.exe 104 PID 4552 set thread context of 1620 4552 updater.exe 105 -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4512 test13.exe 4512 test13.exe 4512 test13.exe 4512 test13.exe 4408 powershell.exe 4408 powershell.exe 4512 test13.exe 4512 test13.exe 4552 updater.exe 4552 updater.exe 4552 updater.exe 4552 updater.exe 3916 powershell.exe 3916 powershell.exe 4552 updater.exe 4552 updater.exe 4552 updater.exe 4552 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1248 powercfg.exe Token: SeCreatePagefilePrivilege 1248 powercfg.exe Token: SeShutdownPrivilege 4428 powercfg.exe Token: SeCreatePagefilePrivilege 4428 powercfg.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeShutdownPrivilege 4560 powercfg.exe Token: SeCreatePagefilePrivilege 4560 powercfg.exe Token: SeShutdownPrivilege 2044 powercfg.exe Token: SeCreatePagefilePrivilege 2044 powercfg.exe Token: SeIncreaseQuotaPrivilege 4408 powershell.exe Token: SeSecurityPrivilege 4408 powershell.exe Token: SeTakeOwnershipPrivilege 4408 powershell.exe Token: SeLoadDriverPrivilege 4408 powershell.exe Token: SeSystemProfilePrivilege 4408 powershell.exe Token: SeSystemtimePrivilege 4408 powershell.exe Token: SeProfSingleProcessPrivilege 4408 powershell.exe Token: SeIncBasePriorityPrivilege 4408 powershell.exe Token: SeCreatePagefilePrivilege 4408 powershell.exe Token: SeBackupPrivilege 4408 powershell.exe Token: SeRestorePrivilege 4408 powershell.exe Token: SeShutdownPrivilege 4408 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeSystemEnvironmentPrivilege 4408 powershell.exe Token: SeRemoteShutdownPrivilege 4408 powershell.exe Token: SeUndockPrivilege 4408 powershell.exe Token: SeManageVolumePrivilege 4408 powershell.exe Token: 33 4408 powershell.exe Token: 34 4408 powershell.exe Token: 35 4408 powershell.exe Token: 36 4408 powershell.exe Token: SeIncreaseQuotaPrivilege 4408 powershell.exe Token: SeSecurityPrivilege 4408 powershell.exe Token: SeTakeOwnershipPrivilege 4408 powershell.exe Token: SeLoadDriverPrivilege 4408 powershell.exe Token: SeSystemProfilePrivilege 4408 powershell.exe Token: SeSystemtimePrivilege 4408 powershell.exe Token: SeProfSingleProcessPrivilege 4408 powershell.exe Token: SeIncBasePriorityPrivilege 4408 powershell.exe Token: SeCreatePagefilePrivilege 4408 powershell.exe Token: SeBackupPrivilege 4408 powershell.exe Token: SeRestorePrivilege 4408 powershell.exe Token: SeShutdownPrivilege 4408 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeSystemEnvironmentPrivilege 4408 powershell.exe Token: SeRemoteShutdownPrivilege 4408 powershell.exe Token: SeUndockPrivilege 4408 powershell.exe Token: SeManageVolumePrivilege 4408 powershell.exe Token: 33 4408 powershell.exe Token: 34 4408 powershell.exe Token: 35 4408 powershell.exe Token: 36 4408 powershell.exe Token: SeIncreaseQuotaPrivilege 4408 powershell.exe Token: SeSecurityPrivilege 4408 powershell.exe Token: SeTakeOwnershipPrivilege 4408 powershell.exe Token: SeLoadDriverPrivilege 4408 powershell.exe Token: SeSystemProfilePrivilege 4408 powershell.exe Token: SeSystemtimePrivilege 4408 powershell.exe Token: SeProfSingleProcessPrivilege 4408 powershell.exe Token: SeIncBasePriorityPrivilege 4408 powershell.exe Token: SeCreatePagefilePrivilege 4408 powershell.exe Token: SeBackupPrivilege 4408 powershell.exe Token: SeRestorePrivilege 4408 powershell.exe Token: SeShutdownPrivilege 4408 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3404 wrote to memory of 1248 3404 cmd.exe 86 PID 3404 wrote to memory of 1248 3404 cmd.exe 86 PID 3404 wrote to memory of 4428 3404 cmd.exe 87 PID 3404 wrote to memory of 4428 3404 cmd.exe 87 PID 3404 wrote to memory of 4560 3404 cmd.exe 88 PID 3404 wrote to memory of 4560 3404 cmd.exe 88 PID 3404 wrote to memory of 2044 3404 cmd.exe 89 PID 3404 wrote to memory of 2044 3404 cmd.exe 89 PID 2212 wrote to memory of 3984 2212 cmd.exe 99 PID 2212 wrote to memory of 3984 2212 cmd.exe 99 PID 2212 wrote to memory of 3976 2212 cmd.exe 100 PID 2212 wrote to memory of 3976 2212 cmd.exe 100 PID 2212 wrote to memory of 2640 2212 cmd.exe 101 PID 2212 wrote to memory of 2640 2212 cmd.exe 101 PID 2212 wrote to memory of 4088 2212 cmd.exe 102 PID 2212 wrote to memory of 4088 2212 cmd.exe 102 PID 4552 wrote to memory of 3560 4552 updater.exe 104 PID 4552 wrote to memory of 1620 4552 updater.exe 105 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\test13.exe"C:\Users\Admin\AppData\Local\Temp\test13.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#efgylltc#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:2624
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:3984
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:3976
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:2640
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:4088
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#efgylltc#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:3560
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1620
-
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD52ac3c9ba89b8c2ef19c601ecebb82157
SHA1a239a4b11438c00e5ff89ebd4a804ede6a01935b
SHA2563c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e
SHA512b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.6MB
MD5dd6511650167bd50c8baf3c321d68cd7
SHA1b7a0cf91f251935969e75628c080bf38f694e6c6
SHA256add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
SHA512da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c
-
Filesize
5.6MB
MD5dd6511650167bd50c8baf3c321d68cd7
SHA1b7a0cf91f251935969e75628c080bf38f694e6c6
SHA256add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
SHA512da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c