Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2023 13:30

General

  • Target

    49037.exe

  • Size

    6.7MB

  • MD5

    b1f6556ce2648139c4faea68dd226520

  • SHA1

    6bd326258e1536aa4a3a7a8bae18e8de5af69f9f

  • SHA256

    397fbdb4b1a71350d390873d70ff32ff992ed73ce699b49794518fa93dfd5f20

  • SHA512

    53428e7145472c4171d8fead376721cdf3b207ef27093b095fa3054863436b79a4d497e2a498c7e4e9af6f55edf24341e9d572c9f96ace20c2ee90c5c6db097f

  • SSDEEP

    196608:e8DQkHOCvp51n5Zt/MA6zBH9Pe8bpQgdYYut5LgQ:39OMjZvm9xFQgdKtD

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • XMRig Miner payload 8 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Themida packer 15 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3144
      • C:\Users\Admin\AppData\Local\Temp\49037.exe
        "C:\Users\Admin\AppData\Local\Temp\49037.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4084
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3892
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1504
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2344
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2244
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wwviaeydz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1840
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:1676
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4696
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
              PID:3840
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
                PID:4072
              • C:\Windows\System32\powercfg.exe
                powercfg /x -standby-timeout-ac 0
                3⤵
                  PID:5000
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  3⤵
                    PID:4996
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wwviaeydz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4504
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3504
              • C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
                C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
                1⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1432

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                Filesize

                3KB

                MD5

                fee026663fcb662152188784794028ee

                SHA1

                3c02a26a9cb16648fad85c6477b68ced3cb0cb45

                SHA256

                dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

                SHA512

                7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                2ac3c9ba89b8c2ef19c601ecebb82157

                SHA1

                a239a4b11438c00e5ff89ebd4a804ede6a01935b

                SHA256

                3c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e

                SHA512

                b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mppz2hej.ta0.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

                Filesize

                6.7MB

                MD5

                b1f6556ce2648139c4faea68dd226520

                SHA1

                6bd326258e1536aa4a3a7a8bae18e8de5af69f9f

                SHA256

                397fbdb4b1a71350d390873d70ff32ff992ed73ce699b49794518fa93dfd5f20

                SHA512

                53428e7145472c4171d8fead376721cdf3b207ef27093b095fa3054863436b79a4d497e2a498c7e4e9af6f55edf24341e9d572c9f96ace20c2ee90c5c6db097f

              • memory/1432-185-0x00007FF6DA8E0000-0x00007FF6DB5CE000-memory.dmp

                Filesize

                12.9MB

              • memory/1432-164-0x00007FF6DA8E0000-0x00007FF6DB5CE000-memory.dmp

                Filesize

                12.9MB

              • memory/1432-163-0x00007FF6DA8E0000-0x00007FF6DB5CE000-memory.dmp

                Filesize

                12.9MB

              • memory/1432-162-0x00007FF6DA8E0000-0x00007FF6DB5CE000-memory.dmp

                Filesize

                12.9MB

              • memory/1432-161-0x00007FF6DA8E0000-0x00007FF6DB5CE000-memory.dmp

                Filesize

                12.9MB

              • memory/1432-160-0x00007FF6DA8E0000-0x00007FF6DB5CE000-memory.dmp

                Filesize

                12.9MB

              • memory/1432-159-0x00007FF6DA8E0000-0x00007FF6DB5CE000-memory.dmp

                Filesize

                12.9MB

              • memory/1840-152-0x000001B314440000-0x000001B314450000-memory.dmp

                Filesize

                64KB

              • memory/1840-151-0x000001B314440000-0x000001B314450000-memory.dmp

                Filesize

                64KB

              • memory/1840-153-0x000001B314440000-0x000001B314450000-memory.dmp

                Filesize

                64KB

              • memory/1840-142-0x000001B32C980000-0x000001B32C9A2000-memory.dmp

                Filesize

                136KB

              • memory/3504-194-0x00007FF75D820000-0x00007FF75E00F000-memory.dmp

                Filesize

                7.9MB

              • memory/3504-196-0x00007FF75D820000-0x00007FF75E00F000-memory.dmp

                Filesize

                7.9MB

              • memory/3504-195-0x00007FF75D820000-0x00007FF75E00F000-memory.dmp

                Filesize

                7.9MB

              • memory/3504-187-0x0000000002960000-0x00000000029A0000-memory.dmp

                Filesize

                256KB

              • memory/3504-193-0x00007FF75D820000-0x00007FF75E00F000-memory.dmp

                Filesize

                7.9MB

              • memory/3504-192-0x00000000029B0000-0x00000000029D0000-memory.dmp

                Filesize

                128KB

              • memory/3504-191-0x00007FF75D820000-0x00007FF75E00F000-memory.dmp

                Filesize

                7.9MB

              • memory/3504-190-0x00000000029B0000-0x00000000029D0000-memory.dmp

                Filesize

                128KB

              • memory/3504-189-0x00007FF75D820000-0x00007FF75E00F000-memory.dmp

                Filesize

                7.9MB

              • memory/3504-188-0x00007FF75D820000-0x00007FF75E00F000-memory.dmp

                Filesize

                7.9MB

              • memory/3504-186-0x0000000000BC0000-0x0000000000BE0000-memory.dmp

                Filesize

                128KB

              • memory/4084-137-0x00007FF6ED810000-0x00007FF6EE4FE000-memory.dmp

                Filesize

                12.9MB

              • memory/4084-134-0x00007FF6ED810000-0x00007FF6EE4FE000-memory.dmp

                Filesize

                12.9MB

              • memory/4084-135-0x00007FF6ED810000-0x00007FF6EE4FE000-memory.dmp

                Filesize

                12.9MB

              • memory/4084-136-0x00007FF6ED810000-0x00007FF6EE4FE000-memory.dmp

                Filesize

                12.9MB

              • memory/4084-157-0x00007FF6ED810000-0x00007FF6EE4FE000-memory.dmp

                Filesize

                12.9MB

              • memory/4084-138-0x00007FF6ED810000-0x00007FF6EE4FE000-memory.dmp

                Filesize

                12.9MB

              • memory/4084-133-0x00007FF6ED810000-0x00007FF6EE4FE000-memory.dmp

                Filesize

                12.9MB

              • memory/4504-181-0x00000269F43B0000-0x00000269F43C0000-memory.dmp

                Filesize

                64KB

              • memory/4504-179-0x00000269F43B0000-0x00000269F43C0000-memory.dmp

                Filesize

                64KB

              • memory/4504-180-0x00000269F43B0000-0x00000269F43C0000-memory.dmp

                Filesize

                64KB

              • memory/4504-178-0x00000269F43B0000-0x00000269F43C0000-memory.dmp

                Filesize

                64KB