7126b9932dc0cdfe751340edfa7c4a14b69262eb1afd0530e6d1fdb2e25986dd

Analysis

max time kernel
150s
max time network
96s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG001.scr
Size

3.4MB
MD5

fbbcf1e9501234d6661a0c9ae6dc01c9
SHA1

1ca9759a324159f331e79ea6871ad62040521b41
SHA256

d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
SHA512

027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140
SSDEEP

98304:M5VPnq1y5tQOM33ZNqCtBixHl54Oyjes1Ro6:2VPq1yLanrqTr43eON

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

IMG001.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk IMG001.exe
Executes dropped EXE 1 IoCs

Processes:

IMG001.exe

pid process

2000 IMG001.exe
Loads dropped DLL 6 IoCs

Processes:

IMG001.scrIMG001.exe

pid process

2008 IMG001.scr
2000 IMG001.exe
2000 IMG001.exe
2000 IMG001.exe
2000 IMG001.exe
2000 IMG001.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk	IMG001.exe

pid	process
2000	IMG001.exe

pid	process
2008	IMG001.scr
2000	IMG001.exe
2000	IMG001.exe
2000	IMG001.exe
2000	IMG001.exe
2000	IMG001.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IMG001.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	IMG001.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run	IMG001.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

IMG001.exe

description ioc process

File opened (read-only) \??\E: IMG001.exe
Drops file in Windows directory 1 IoCs

Processes:

schtasks.exe

description ioc process

File created C:\Windows\Tasks\UAC.job schtasks.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\E:	IMG001.exe

description	ioc	process
File created	C:\Windows\Tasks\UAC.job	schtasks.exe

NSIS installer 10 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_1
\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_2
\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_1
\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe	nsis_installer_2

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

632 schtasks.exe
1480 schtasks.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powercfg.exepowercfg.exepowercfg.exe

description pid process

Token: SeShutdownPrivilege 836 powercfg.exe
Token: SeShutdownPrivilege 1076 powercfg.exe
Token: SeShutdownPrivilege 1624 powercfg.exe

pid	process
632	schtasks.exe
1480	schtasks.exe

description	pid	process
Token: SeShutdownPrivilege	836	powercfg.exe
Token: SeShutdownPrivilege	1076	powercfg.exe
Token: SeShutdownPrivilege	1624	powercfg.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

IMG001.scrIMG001.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 2000	2008	IMG001.scr	IMG001.exe
PID 2008 wrote to memory of 2000	2008	IMG001.scr	IMG001.exe
PID 2008 wrote to memory of 2000	2008	IMG001.scr	IMG001.exe
PID 2008 wrote to memory of 2000	2008	IMG001.scr	IMG001.exe
PID 2000 wrote to memory of 1396	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1396	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1396	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1396	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1152	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1152	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1152	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1152	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1872	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1872	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1872	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 1872	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 980	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 980	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 980	2000	IMG001.exe	cmd.exe
PID 2000 wrote to memory of 980	2000	IMG001.exe	cmd.exe
PID 1872 wrote to memory of 1480	1872	cmd.exe	schtasks.exe
PID 1872 wrote to memory of 1480	1872	cmd.exe	schtasks.exe
PID 1872 wrote to memory of 1480	1872	cmd.exe	schtasks.exe
PID 1872 wrote to memory of 1480	1872	cmd.exe	schtasks.exe
PID 1396 wrote to memory of 1476	1396	cmd.exe	reg.exe
PID 1396 wrote to memory of 1476	1396	cmd.exe	reg.exe
PID 1396 wrote to memory of 1476	1396	cmd.exe	reg.exe
PID 1396 wrote to memory of 1476	1396	cmd.exe	reg.exe
PID 980 wrote to memory of 836	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 836	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 836	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 836	980	cmd.exe	powercfg.exe
PID 1152 wrote to memory of 632	1152	cmd.exe	schtasks.exe
PID 1152 wrote to memory of 632	1152	cmd.exe	schtasks.exe
PID 1152 wrote to memory of 632	1152	cmd.exe	schtasks.exe
PID 1152 wrote to memory of 632	1152	cmd.exe	schtasks.exe
PID 980 wrote to memory of 1076	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 1076	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 1076	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 1076	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 1624	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 1624	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 1624	980	cmd.exe	powercfg.exe
PID 980 wrote to memory of 1624	980	cmd.exe	powercfg.exe

C:\Users\Admin\AppData\Local\Temp\IMG001.scr
"C:\Users\Admin\AppData\Local\Temp\IMG001.scr" /S
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
3⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
4⤵
- Adds Run key to start application
PID:1476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
4⤵
- Creates scheduled task(s)
PID:632

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1480

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
3⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\powercfg.exe
powercfg /CHANGE -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Windows\SysWOW64\powercfg.exe
powercfg /CHANGE -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\SysWOW64\powercfg.exe
Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj2C51.tmp\inetc.dll
Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
Filesize
3.4MB

MD5
fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1
1ca9759a324159f331e79ea6871ad62040521b41

SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Download Submit
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
Filesize
3.4MB

MD5
fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1
1ca9759a324159f331e79ea6871ad62040521b41

SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Download Submit
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
Filesize
3.4MB

MD5
fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1
1ca9759a324159f331e79ea6871ad62040521b41

SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Download Submit
\Users\Admin\AppData\Local\Temp\nsj2C51.tmp\inetc.dll
Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsj2C51.tmp\inetc.dll
Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsj2C51.tmp\inetc.dll
Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsj2C51.tmp\inetc.dll
Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
Filesize
3.4MB

MD5
fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1
1ca9759a324159f331e79ea6871ad62040521b41

SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Download Submit
\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
Filesize
3.4MB

MD5
fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1
1ca9759a324159f331e79ea6871ad62040521b41

SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140

Download Submit