Analysis
-
max time kernel
1800s -
max time network
1791s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2023, 12:28
Static task
static1
Behavioral task
behavioral1
Sample
test13.exe
Resource
win10-20230220-en
windows10-1703-x64
12 signatures
1800 seconds
Behavioral task
behavioral2
Sample
test13.exe
Resource
win7-20230220-en
windows7-x64
13 signatures
1800 seconds
General
-
Target
test13.exe
-
Size
5.6MB
-
MD5
dd6511650167bd50c8baf3c321d68cd7
-
SHA1
b7a0cf91f251935969e75628c080bf38f694e6c6
-
SHA256
add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
-
SHA512
da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c
-
SSDEEP
98304:tR4QavOFDCN/Li9/oDsBaSnEolKi8JBoazSzZMrq7g2FWO2kBcQf41/9UMbKTurd:tnaEDCNOp5EolKi8JTS2wg2FWO2kP41R
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
description pid Process procid_target PID 4288 created 3184 4288 test13.exe 79 PID 4288 created 3184 4288 test13.exe 79 PID 4288 created 3184 4288 test13.exe 79 PID 412 created 3184 412 updater.exe 79 PID 412 created 3184 412 updater.exe 79 PID 412 created 3184 412 updater.exe 79 -
XMRig Miner payload 31 IoCs
resource yara_rule behavioral3/memory/412-172-0x00007FF6CBDE0000-0x00007FF6CC37A000-memory.dmp xmrig behavioral3/memory/1500-176-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-178-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-182-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-186-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-188-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-190-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-192-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-194-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-196-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-198-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-200-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-202-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-204-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-206-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-208-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-210-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-212-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-214-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-216-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-218-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-220-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-222-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-224-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-226-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-228-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-234-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-236-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-238-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-240-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig behavioral3/memory/1500-242-0x00007FF6997C0000-0x00007FF699FAF000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
pid Process 412 updater.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 412 set thread context of 4156 412 updater.exe 106 PID 412 set thread context of 1500 412 updater.exe 107 -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 4288 test13.exe 4288 test13.exe 4288 test13.exe 4288 test13.exe 5084 powershell.exe 5084 powershell.exe 4288 test13.exe 4288 test13.exe 412 updater.exe 412 updater.exe 412 updater.exe 412 updater.exe 412 updater.exe 4932 powershell.exe 4932 powershell.exe 412 updater.exe 412 updater.exe 412 updater.exe 412 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2936 powercfg.exe Token: SeCreatePagefilePrivilege 2936 powercfg.exe Token: SeShutdownPrivilege 4680 powercfg.exe Token: SeCreatePagefilePrivilege 4680 powercfg.exe Token: SeDebugPrivilege 5084 powershell.exe Token: SeShutdownPrivilege 2052 powercfg.exe Token: SeCreatePagefilePrivilege 2052 powercfg.exe Token: SeShutdownPrivilege 3536 powercfg.exe Token: SeCreatePagefilePrivilege 3536 powercfg.exe Token: SeIncreaseQuotaPrivilege 5084 powershell.exe Token: SeSecurityPrivilege 5084 powershell.exe Token: SeTakeOwnershipPrivilege 5084 powershell.exe Token: SeLoadDriverPrivilege 5084 powershell.exe Token: SeSystemProfilePrivilege 5084 powershell.exe Token: SeSystemtimePrivilege 5084 powershell.exe Token: SeProfSingleProcessPrivilege 5084 powershell.exe Token: SeIncBasePriorityPrivilege 5084 powershell.exe Token: SeCreatePagefilePrivilege 5084 powershell.exe Token: SeBackupPrivilege 5084 powershell.exe Token: SeRestorePrivilege 5084 powershell.exe Token: SeShutdownPrivilege 5084 powershell.exe Token: SeDebugPrivilege 5084 powershell.exe Token: SeSystemEnvironmentPrivilege 5084 powershell.exe Token: SeRemoteShutdownPrivilege 5084 powershell.exe Token: SeUndockPrivilege 5084 powershell.exe Token: SeManageVolumePrivilege 5084 powershell.exe Token: 33 5084 powershell.exe Token: 34 5084 powershell.exe Token: 35 5084 powershell.exe Token: 36 5084 powershell.exe Token: SeIncreaseQuotaPrivilege 5084 powershell.exe Token: SeSecurityPrivilege 5084 powershell.exe Token: SeTakeOwnershipPrivilege 5084 powershell.exe Token: SeLoadDriverPrivilege 5084 powershell.exe Token: SeSystemProfilePrivilege 5084 powershell.exe Token: SeSystemtimePrivilege 5084 powershell.exe Token: SeProfSingleProcessPrivilege 5084 powershell.exe Token: SeIncBasePriorityPrivilege 5084 powershell.exe Token: SeCreatePagefilePrivilege 5084 powershell.exe Token: SeBackupPrivilege 5084 powershell.exe Token: SeRestorePrivilege 5084 powershell.exe Token: SeShutdownPrivilege 5084 powershell.exe Token: SeDebugPrivilege 5084 powershell.exe Token: SeSystemEnvironmentPrivilege 5084 powershell.exe Token: SeRemoteShutdownPrivilege 5084 powershell.exe Token: SeUndockPrivilege 5084 powershell.exe Token: SeManageVolumePrivilege 5084 powershell.exe Token: 33 5084 powershell.exe Token: 34 5084 powershell.exe Token: 35 5084 powershell.exe Token: 36 5084 powershell.exe Token: SeIncreaseQuotaPrivilege 5084 powershell.exe Token: SeSecurityPrivilege 5084 powershell.exe Token: SeTakeOwnershipPrivilege 5084 powershell.exe Token: SeLoadDriverPrivilege 5084 powershell.exe Token: SeSystemProfilePrivilege 5084 powershell.exe Token: SeSystemtimePrivilege 5084 powershell.exe Token: SeProfSingleProcessPrivilege 5084 powershell.exe Token: SeIncBasePriorityPrivilege 5084 powershell.exe Token: SeCreatePagefilePrivilege 5084 powershell.exe Token: SeBackupPrivilege 5084 powershell.exe Token: SeRestorePrivilege 5084 powershell.exe Token: SeShutdownPrivilege 5084 powershell.exe Token: SeDebugPrivilege 5084 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4656 wrote to memory of 2936 4656 cmd.exe 89 PID 4656 wrote to memory of 2936 4656 cmd.exe 89 PID 4656 wrote to memory of 4680 4656 cmd.exe 90 PID 4656 wrote to memory of 4680 4656 cmd.exe 90 PID 4656 wrote to memory of 2052 4656 cmd.exe 91 PID 4656 wrote to memory of 2052 4656 cmd.exe 91 PID 4656 wrote to memory of 3536 4656 cmd.exe 92 PID 4656 wrote to memory of 3536 4656 cmd.exe 92 PID 3976 wrote to memory of 1144 3976 cmd.exe 100 PID 3976 wrote to memory of 1144 3976 cmd.exe 100 PID 3976 wrote to memory of 1084 3976 cmd.exe 101 PID 3976 wrote to memory of 1084 3976 cmd.exe 101 PID 3976 wrote to memory of 2568 3976 cmd.exe 102 PID 3976 wrote to memory of 2568 3976 cmd.exe 102 PID 3976 wrote to memory of 3148 3976 cmd.exe 103 PID 3976 wrote to memory of 3148 3976 cmd.exe 103 PID 412 wrote to memory of 4156 412 updater.exe 106 PID 412 wrote to memory of 1500 412 updater.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\test13.exe"C:\Users\Admin\AppData\Local\Temp\test13.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4288
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#efgylltc#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:2200
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:1144
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:1084
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:2568
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:3148
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:4156
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1500
-
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#efgylltc#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD55d2242ff9dc07b67553123b3c939974d
SHA1ec7b42a468cdb04f1403cd18f67aa4d5af6c5a7f
SHA25627845ed84cb47c4ba2883bdd75c0a0be7035060f6ac845ca256a391bee640716
SHA51225b081ed892b9bc03a7f77c16d110fdc8f03d118689f9773fff258e78a65c0e94c01886e01a4ba0cf5cb7bdb0d7e1e1babb58e1db4ba2582a4e1125b80ebd0ee
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.6MB
MD5dd6511650167bd50c8baf3c321d68cd7
SHA1b7a0cf91f251935969e75628c080bf38f694e6c6
SHA256add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
SHA512da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c
-
Filesize
5.6MB
MD5dd6511650167bd50c8baf3c321d68cd7
SHA1b7a0cf91f251935969e75628c080bf38f694e6c6
SHA256add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
SHA512da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c