Analysis
-
max time kernel
1800s -
max time network
1803s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2023, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
test13.exe
Resource
win10-20230220-en
windows10-1703-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
test13.exe
Resource
win7-20230220-en
windows7-x64
13 signatures
1800 seconds
General
-
Target
test13.exe
-
Size
5.6MB
-
MD5
dd6511650167bd50c8baf3c321d68cd7
-
SHA1
b7a0cf91f251935969e75628c080bf38f694e6c6
-
SHA256
add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
-
SHA512
da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c
-
SSDEEP
98304:tR4QavOFDCN/Li9/oDsBaSnEolKi8JBoazSzZMrq7g2FWO2kBcQf41/9UMbKTurd:tnaEDCNOp5EolKi8JTS2wg2FWO2kP41R
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
description pid Process procid_target PID 3824 created 408 3824 test13.exe 60 PID 3824 created 408 3824 test13.exe 60 PID 3824 created 408 3824 test13.exe 60 PID 224 created 408 224 updater.exe 60 PID 224 created 408 224 updater.exe 60 PID 224 created 408 224 updater.exe 60 PID 224 created 408 224 updater.exe 60 -
XMRig Miner payload 31 IoCs
resource yara_rule behavioral3/memory/224-169-0x00007FF66F320000-0x00007FF66F8BA000-memory.dmp xmrig behavioral3/memory/3448-173-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-177-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-181-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-183-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-185-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-187-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-189-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-191-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-193-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-199-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-201-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-203-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-205-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-207-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-209-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-211-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-213-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-215-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-217-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-219-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-221-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-223-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-225-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-227-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-229-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-231-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-233-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-235-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-237-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig behavioral3/memory/3448-239-0x00007FF6E8B40000-0x00007FF6E932F000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
pid Process 224 updater.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 224 set thread context of 4552 224 updater.exe 105 PID 224 set thread context of 3448 224 updater.exe 106 -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3824 test13.exe 3824 test13.exe 3824 test13.exe 3824 test13.exe 4576 powershell.exe 4576 powershell.exe 3824 test13.exe 3824 test13.exe 224 updater.exe 224 updater.exe 224 updater.exe 224 updater.exe 1100 powershell.exe 1100 powershell.exe 224 updater.exe 224 updater.exe 224 updater.exe 224 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 860 powercfg.exe Token: SeCreatePagefilePrivilege 860 powercfg.exe Token: SeShutdownPrivilege 3768 powercfg.exe Token: SeCreatePagefilePrivilege 3768 powercfg.exe Token: SeDebugPrivilege 4576 powershell.exe Token: SeShutdownPrivilege 1592 powercfg.exe Token: SeCreatePagefilePrivilege 1592 powercfg.exe Token: SeShutdownPrivilege 3268 powercfg.exe Token: SeCreatePagefilePrivilege 3268 powercfg.exe Token: SeIncreaseQuotaPrivilege 4576 powershell.exe Token: SeSecurityPrivilege 4576 powershell.exe Token: SeTakeOwnershipPrivilege 4576 powershell.exe Token: SeLoadDriverPrivilege 4576 powershell.exe Token: SeSystemProfilePrivilege 4576 powershell.exe Token: SeSystemtimePrivilege 4576 powershell.exe Token: SeProfSingleProcessPrivilege 4576 powershell.exe Token: SeIncBasePriorityPrivilege 4576 powershell.exe Token: SeCreatePagefilePrivilege 4576 powershell.exe Token: SeBackupPrivilege 4576 powershell.exe Token: SeRestorePrivilege 4576 powershell.exe Token: SeShutdownPrivilege 4576 powershell.exe Token: SeDebugPrivilege 4576 powershell.exe Token: SeSystemEnvironmentPrivilege 4576 powershell.exe Token: SeRemoteShutdownPrivilege 4576 powershell.exe Token: SeUndockPrivilege 4576 powershell.exe Token: SeManageVolumePrivilege 4576 powershell.exe Token: 33 4576 powershell.exe Token: 34 4576 powershell.exe Token: 35 4576 powershell.exe Token: 36 4576 powershell.exe Token: SeIncreaseQuotaPrivilege 4576 powershell.exe Token: SeSecurityPrivilege 4576 powershell.exe Token: SeTakeOwnershipPrivilege 4576 powershell.exe Token: SeLoadDriverPrivilege 4576 powershell.exe Token: SeSystemProfilePrivilege 4576 powershell.exe Token: SeSystemtimePrivilege 4576 powershell.exe Token: SeProfSingleProcessPrivilege 4576 powershell.exe Token: SeIncBasePriorityPrivilege 4576 powershell.exe Token: SeCreatePagefilePrivilege 4576 powershell.exe Token: SeBackupPrivilege 4576 powershell.exe Token: SeRestorePrivilege 4576 powershell.exe Token: SeShutdownPrivilege 4576 powershell.exe Token: SeDebugPrivilege 4576 powershell.exe Token: SeSystemEnvironmentPrivilege 4576 powershell.exe Token: SeRemoteShutdownPrivilege 4576 powershell.exe Token: SeUndockPrivilege 4576 powershell.exe Token: SeManageVolumePrivilege 4576 powershell.exe Token: 33 4576 powershell.exe Token: 34 4576 powershell.exe Token: 35 4576 powershell.exe Token: 36 4576 powershell.exe Token: SeIncreaseQuotaPrivilege 4576 powershell.exe Token: SeSecurityPrivilege 4576 powershell.exe Token: SeTakeOwnershipPrivilege 4576 powershell.exe Token: SeLoadDriverPrivilege 4576 powershell.exe Token: SeSystemProfilePrivilege 4576 powershell.exe Token: SeSystemtimePrivilege 4576 powershell.exe Token: SeProfSingleProcessPrivilege 4576 powershell.exe Token: SeIncBasePriorityPrivilege 4576 powershell.exe Token: SeCreatePagefilePrivilege 4576 powershell.exe Token: SeBackupPrivilege 4576 powershell.exe Token: SeRestorePrivilege 4576 powershell.exe Token: SeShutdownPrivilege 4576 powershell.exe Token: SeDebugPrivilege 4576 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe 3448 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2328 wrote to memory of 860 2328 cmd.exe 88 PID 2328 wrote to memory of 860 2328 cmd.exe 88 PID 2328 wrote to memory of 3768 2328 cmd.exe 89 PID 2328 wrote to memory of 3768 2328 cmd.exe 89 PID 2328 wrote to memory of 1592 2328 cmd.exe 90 PID 2328 wrote to memory of 1592 2328 cmd.exe 90 PID 2328 wrote to memory of 3268 2328 cmd.exe 91 PID 2328 wrote to memory of 3268 2328 cmd.exe 91 PID 4532 wrote to memory of 2432 4532 cmd.exe 99 PID 4532 wrote to memory of 2432 4532 cmd.exe 99 PID 4532 wrote to memory of 4008 4532 cmd.exe 100 PID 4532 wrote to memory of 4008 4532 cmd.exe 100 PID 4532 wrote to memory of 1644 4532 cmd.exe 101 PID 4532 wrote to memory of 1644 4532 cmd.exe 101 PID 4532 wrote to memory of 4452 4532 cmd.exe 102 PID 4532 wrote to memory of 4452 4532 cmd.exe 102 PID 224 wrote to memory of 4552 224 updater.exe 105 PID 224 wrote to memory of 3448 224 updater.exe 106 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\test13.exe"C:\Users\Admin\AppData\Local\Temp\test13.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:3824
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#efgylltc#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:3188
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:2432
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:4008
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:1644
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:4452
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#efgylltc#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:4552
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3448
-
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:224
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD562ba4ea474aa0661cb364833cd6f342e
SHA1bedea24ce0ef32bd8396e3b8f1fc6c2f27d49420
SHA2562c470425abe0953386b291a5539ce6530beb77d03743356c6606de1332dedad5
SHA512b97f14afab17976e43fbb953bea4a1b1fb98f15efd9267fca7e67cf23ed53bdeb5b9b6d2e3b7fca7df858b9f1d154da62200d4819d2eeab39aa998352211f621
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.6MB
MD5dd6511650167bd50c8baf3c321d68cd7
SHA1b7a0cf91f251935969e75628c080bf38f694e6c6
SHA256add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
SHA512da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c
-
Filesize
5.6MB
MD5dd6511650167bd50c8baf3c321d68cd7
SHA1b7a0cf91f251935969e75628c080bf38f694e6c6
SHA256add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
SHA512da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c