Analysis
-
max time kernel
160s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
01/07/2023, 08:29
General
-
Target
F-VPN.exe
-
Size
7.1MB
-
MD5
7106aab423db77a92c6e97a70bc8ef84
-
SHA1
ffa5faac3ffd055869f5e5ee1a8106dc6a6cdea7
-
SHA256
bf92cc39c4a885688598416d73f1d720023b7ff573224ab6b0790a042983245b
-
SHA512
76fe0b1fbe366708ad53bbaa67a686e4fe7c5f59099c4143c88c032d0d3fdea977af7f4c43b93f8a6108ccb7a6c2361a7bed91de8f99e00e248275d781e18c2a
-
SSDEEP
196608:l4R4y6i8QjS6/4osJem6/QBDpnDpxGTlO9enTtK6eq/g:y4O8QjVsJe//ANnD6TE9ecv3
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 13 IoCs
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\F-VPN.exe"C:\Users\Admin\AppData\Local\Temp\F-VPN.exe"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\srf.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\srf.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Server.vbs"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#eujmqqr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\srf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#eujmqqr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD562032a79f8416ef5fe25b81955c2f5dd
SHA19c996b27944668b8fe4a490d7c1a99e94efa190c
SHA25602a537f84c804887adbfe6404b5b7e060cbe22204206d17cafb3f86c02e594fe
SHA512f58610ff90367e6b4fa6eaeb9778e3d3032df44bf9577ddd338beaca7201a150709bcdfe38cf88039f4009cba22bcb11099562d2b01ac1089f4d6ee38cdead28
-
Filesize
68B
MD5478b0463ff5e4688026acce0001bd938
SHA1dabc6987cc86106e38572458e0768de3093d74a2
SHA256474d94be4055c44a330e75ed1e81a82261916a090779285952aed22b1e597967
SHA5124684298816b0c9654cae1e621445c75ba90fe6d31457b4a724e9a6e55bacd202b67c50cf72b2fbb20d2b5ef76cbd22a805db22b89b20cb8703913386c43b1787
-
Filesize
11.9MB
MD5bd5df58cba552dd3a856fc24303e5dfe
SHA1549720252ef69b9f8ad6eccce47f953be2e41933
SHA2563a00b3c8271e9f8230ae038523a7658ce6e1cb365dd45a2b727840c9eb3e762f
SHA51253fa99414f7023ba6d5835b98c7f97887c9861219abb045d7f5a186353f7592f9a2d08be0a949c40f9e691511539a95ec918443428796a99b1989fe6080ce54d
-
Filesize
11.9MB
MD5bd5df58cba552dd3a856fc24303e5dfe
SHA1549720252ef69b9f8ad6eccce47f953be2e41933
SHA2563a00b3c8271e9f8230ae038523a7658ce6e1cb365dd45a2b727840c9eb3e762f
SHA51253fa99414f7023ba6d5835b98c7f97887c9861219abb045d7f5a186353f7592f9a2d08be0a949c40f9e691511539a95ec918443428796a99b1989fe6080ce54d
-
Filesize
11.9MB
MD5bd5df58cba552dd3a856fc24303e5dfe
SHA1549720252ef69b9f8ad6eccce47f953be2e41933
SHA2563a00b3c8271e9f8230ae038523a7658ce6e1cb365dd45a2b727840c9eb3e762f
SHA51253fa99414f7023ba6d5835b98c7f97887c9861219abb045d7f5a186353f7592f9a2d08be0a949c40f9e691511539a95ec918443428796a99b1989fe6080ce54d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
11.9MB
MD5bd5df58cba552dd3a856fc24303e5dfe
SHA1549720252ef69b9f8ad6eccce47f953be2e41933
SHA2563a00b3c8271e9f8230ae038523a7658ce6e1cb365dd45a2b727840c9eb3e762f
SHA51253fa99414f7023ba6d5835b98c7f97887c9861219abb045d7f5a186353f7592f9a2d08be0a949c40f9e691511539a95ec918443428796a99b1989fe6080ce54d
-
Filesize
11.9MB
MD5bd5df58cba552dd3a856fc24303e5dfe
SHA1549720252ef69b9f8ad6eccce47f953be2e41933
SHA2563a00b3c8271e9f8230ae038523a7658ce6e1cb365dd45a2b727840c9eb3e762f
SHA51253fa99414f7023ba6d5835b98c7f97887c9861219abb045d7f5a186353f7592f9a2d08be0a949c40f9e691511539a95ec918443428796a99b1989fe6080ce54d
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
128KB
-
Filesize
10.3MB
-
Filesize
128KB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
128KB
-
Filesize
10.3MB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
14.0MB
-
Filesize
14.0MB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
14.0MB
-
Filesize
14.0MB
-
Filesize
14.0MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.1MB