4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe
Size

5.3MB
MD5

b59631e064541c8651576128708e50f9
SHA1

7aae996d4990f37a48288fa5f15a7889c3ff49b3
SHA256

4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002
SHA512

571a06f0ec88fe3697388195dd0a7f7e8d63945748855d928fb5005b51fd2c2baea1a63bd871ed0cfade5eabb879f577b7b04f9cd4d1222de52da641feee1f92
SSDEEP

98304:69w8PMOW9ZI6aO7sd/mzt5mAiN1vw+/YR8ov/bkMJmJZNOnTdjyip:ndIV0G/mzsN1vl/YRV4MY9OnTdjy

Score

8^/10

evasion persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	Miner.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe

Executes dropped EXE 3 IoCs

pid	Process
4184	Miner.exe
5036	Shortcutter.exe
2420	whrbuflqwhah.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
29	raw.githubusercontent.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	Miner.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4184 set thread context of 4608	4184	Miner.exe	124

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1600	sc.exe
4380	sc.exe
3556	sc.exe
1216	sc.exe
912	sc.exe
1428	sc.exe
4344	sc.exe
4868	sc.exe
2376	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2712	powershell.exe
2712	powershell.exe
2712	powershell.exe
4184	Miner.exe
1556	powershell.exe
1556	powershell.exe
1556	powershell.exe
4184	Miner.exe
4184	Miner.exe
4184	Miner.exe
4184	Miner.exe
4184	Miner.exe
4184	Miner.exe
4184	Miner.exe
4184	Miner.exe
4608	dialer.exe
4608	dialer.exe
4184	Miner.exe
4184	Miner.exe
4184	Miner.exe
4184	Miner.exe
4608	dialer.exe
4608	dialer.exe
2420	whrbuflqwhah.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1828	Process not Found
1000	Process not Found
4368	Process not Found
1280	Process not Found
2840	Process not Found
1896	Process not Found
3060	Process not Found
3576	Process not Found
3324	Process not Found
4876	Process not Found
4724	Process not Found
5020	Process not Found
2024	Process not Found
3856	Process not Found
3960	Process not Found
4140	Process not Found
2600	Process not Found
2604	Process not Found
788	Process not Found
2292	Process not Found
4568	Process not Found
3940	Process not Found
2364	Process not Found
1720	Process not Found
2716	Process not Found
2180	Process not Found
924	Process not Found
1312	Process not Found
4048	Process not Found
2160	Process not Found
3600	Process not Found
1204	Process not Found
2736	Process not Found
2900	Process not Found
2936	Process not Found
3004	Process not Found
2656	Process not Found
3860	Process not Found
2240	Process not Found
3036	Process not Found
3976	Process not Found
2572	Process not Found
3980	Process not Found
2312	Process not Found
3304	Process not Found
4768	Process not Found
4260	Process not Found
3200	Process not Found
4480	Process not Found
3804	Process not Found
4880	Process not Found
1212	Process not Found
2700	Process not Found
3152	Process not Found
2848	Process not Found
4504	Process not Found
4360	Process not Found
1904	Process not Found
2096	Process not Found
4760	Process not Found
4952	Process not Found
1732	Process not Found
2488	Process not Found
1568	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	Shortcutter.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	4608	dialer.exe
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
408	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2712	4368	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	96
PID 4368 wrote to memory of 2712	4368	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	96
PID 4368 wrote to memory of 2712	4368	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	96
PID 4368 wrote to memory of 4184	4368	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	99
PID 4368 wrote to memory of 4184	4368	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	99
PID 4368 wrote to memory of 5036	4368	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	100
PID 4368 wrote to memory of 5036	4368	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	100
PID 1068 wrote to memory of 4480	1068	cmd.exe	114
PID 1068 wrote to memory of 4480	1068	cmd.exe	114
PID 4184 wrote to memory of 4608	4184	Miner.exe	124
PID 4184 wrote to memory of 4608	4184	Miner.exe	124
PID 4184 wrote to memory of 4608	4184	Miner.exe	124
PID 4184 wrote to memory of 4608	4184	Miner.exe	124
PID 4184 wrote to memory of 4608	4184	Miner.exe	124
PID 4184 wrote to memory of 4608	4184	Miner.exe	124
PID 4184 wrote to memory of 4608	4184	Miner.exe	124
PID 4852 wrote to memory of 1416	4852	cmd.exe	135
PID 4852 wrote to memory of 1416	4852	cmd.exe	135
PID 4608 wrote to memory of 604	4608	dialer.exe	5
PID 4608 wrote to memory of 672	4608	dialer.exe	7
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 4608 wrote to memory of 948	4608	dialer.exe	12
PID 4608 wrote to memory of 1020	4608	dialer.exe	13
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 4608 wrote to memory of 392	4608	dialer.exe	14
PID 4608 wrote to memory of 408	4608	dialer.exe	15
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 4608 wrote to memory of 864	4608	dialer.exe	16
PID 4608 wrote to memory of 1120	4608	dialer.exe	18
PID 4608 wrote to memory of 1140	4608	dialer.exe	19
PID 4608 wrote to memory of 1148	4608	dialer.exe	20
PID 4608 wrote to memory of 1156	4608	dialer.exe	21
PID 4608 wrote to memory of 1224	4608	dialer.exe	22
PID 4608 wrote to memory of 1304	4608	dialer.exe	23
PID 4608 wrote to memory of 1336	4608	dialer.exe	24
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50
PID 672 wrote to memory of 2872	672	lsass.exe	50

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
- Suspicious use of UnmapMainImage
PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1336

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2872

C:\Users\Admin\AppData\Local\Temp\4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe
"C:\Users\Admin\AppData\Local\Temp\4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAZQBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAcQBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAZwBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAaABlACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Users\Admin\AppData\Roaming\Miner.exe
  "C:\Users\Admin\AppData\Roaming\Miner.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4480
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:912
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1428
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1600
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4868
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2376
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4608
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "RYVSUJUA"
    3⤵
    - Launches sc.exe
    PID:4380
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3556
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1216
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "RYVSUJUA"
    3⤵
    - Launches sc.exe
    PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Miner.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1416
- C:\Users\Admin\AppData\Roaming\Shortcutter.exe
  "C:\Users\Admin\AppData\Roaming\Shortcutter.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5036

C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2420
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3220

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4032

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4556

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1216

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:512

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe

Filesize
896KB

MD5
204522719bb482c2f64760a9df2bd728

SHA1
6f5fe82ad904b6201ef856535f7f81ceda0d05d6

SHA256
130ade95da6ade5d0e3b1c61003b43c419b289c3bef84e2357fa4bd412f5dbd0

SHA512
3c692e76a23127ea87bc40e43f658396a9d73a9d0e739f5e0316df9582a80cecd76f7a7c940e3c9d434f9985ae578deb4364c0a049eae4e0a120785c3143157a

Download Submit
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe

Filesize
64KB

MD5
65a1db0775e09e36857f260e4c38d8e7

SHA1
df9a90c72d07f270e939e788793a3cc0297b1579

SHA256
ce9a23fd46e8e6ca4d1a9d015e2f93f49917613125f0c3b64420414b7bf22646

SHA512
b809c41936aa02c624f63e910001fb72a03a12c97fe336a5233dfb2be52178593c39b02629a9a6899d7560d169e8027f6f8f26a7e71b7394fd6a0d0cb0037308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
9a9df75276bc81225ce3530f317672c9

SHA1
9c6b6ed0f00aade9723ba4d78305173fa14786a5

SHA256
3edcb8b86ae48b7d0d8ce19a7f691a3e11ff47282a9c127c4555aefde3b5277e

SHA512
8f31aafe439ecdfc98c7c73990eb1b2dd924019912c6894f9f6c709c239e8a9495fe81143b338ceb8b6a182ce5e8c7294bb0b33d59f635af3b1bd711a7e6903f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opvco2yc.2cz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Miner.exe

Filesize
3.4MB

MD5
feef983e125ad7afc1a68a5170028424

SHA1
0f9323bc359a963a13e70d6e9ec666b97c8dcd7d

SHA256
22a5f4ba70fbc5c2a4085e6b8df396bff88c4b496e4a362fa37eef2dd5b58c65

SHA512
c42a1767b55a264e87de46c3dfbe016d87d2f2a9f8b09cd06424cc33554848f5de4673a0e4bd0af7dd266c69221010d5d43222273aae156700d1738820f37571

Download Submit
C:\Users\Admin\AppData\Roaming\Miner.exe

Filesize
1.8MB

MD5
464cd3cca1f63443d7533abc298b39f0

SHA1
57163151753ab3772f3b987d7306c6618cb90fcf

SHA256
cd0aa494395a33007cd57a9301c9ed46cc65a241cd8957bd818f2e57f723c053

SHA512
908f44ada6bb3ae3d3e48672bc1e6eaf7c6b0f0c911190310bd0e28170074a8ab2c6792cfdb8bad51e8b887e4f0fdbe5ad0ba0c856c1cb90490d8f9c5980c80f

Download Submit
C:\Users\Admin\AppData\Roaming\Miner.exe

Filesize
3.9MB

MD5
18dc321adc979032db9a49761a276b66

SHA1
e7ca748045ad8a3dfcf0f88b2a6aa966e95c304a

SHA256
d832751de7b0724b1391d6fce83807c37d6468c10a458dd29e23139c68fcea3f

SHA512
f67325e435e683afad426273bf56530d42abf740e3ba791f4171b4ba0506c7f49f8a70506954e4ab3e95f561073953bc504647862d91469e7ee9a09b57f8f090

Download Submit
C:\Users\Admin\AppData\Roaming\Shortcutter.exe

Filesize
50KB

MD5
4ce8fc5016e97f84dadaf983cca845f2

SHA1
0d6fb5a16442cf393d5658a9f40d2501d8fd725c

SHA256
f4da7f22e8eb28cfd8ecb0c3fdc8923b2ba5c5e96b917cbcf53b6bbed1c22551

SHA512
4adeb4774ca136a085bc92cf6f02aa340f927ae12e1db90e8a2be69ef045611d333904ef5714c876ab03f8bcc52ee0140e724bd1659b9cf9eacf0a7d6a7bdd46

Download Submit
memory/392-120-0x0000024096B00000-0x0000024096B2B000-memory.dmp

Filesize
172KB

Download
memory/392-123-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/392-131-0x0000024096B00000-0x0000024096B2B000-memory.dmp

Filesize
172KB

Download
memory/408-122-0x000002070A770000-0x000002070A79B000-memory.dmp

Filesize
172KB

Download
memory/408-132-0x000002070A770000-0x000002070A79B000-memory.dmp

Filesize
172KB

Download
memory/408-126-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/604-172-0x000001775CE60000-0x000001775CE8B000-memory.dmp

Filesize
172KB

Download
memory/604-118-0x00007FF87808D000-0x00007FF87808E000-memory.dmp

Filesize
4KB

Download
memory/604-105-0x000001775CE60000-0x000001775CE8B000-memory.dmp

Filesize
172KB

Download
memory/604-102-0x000001775CA30000-0x000001775CA54000-memory.dmp

Filesize
144KB

Download
memory/604-171-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/604-115-0x000001775CE60000-0x000001775CE8B000-memory.dmp

Filesize
172KB

Download
memory/672-106-0x000001CE69000000-0x000001CE6902B000-memory.dmp

Filesize
172KB

Download
memory/672-124-0x00007FF87808D000-0x00007FF87808E000-memory.dmp

Filesize
4KB

Download
memory/672-121-0x000001CE69000000-0x000001CE6902B000-memory.dmp

Filesize
172KB

Download
memory/672-108-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/864-139-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/864-137-0x0000017E8A560000-0x0000017E8A58B000-memory.dmp

Filesize
172KB

Download
memory/864-146-0x0000017E8A560000-0x0000017E8A58B000-memory.dmp

Filesize
172KB

Download
memory/948-116-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/948-127-0x0000026B9FFA0000-0x0000026B9FFCB000-memory.dmp

Filesize
172KB

Download
memory/948-111-0x0000026B9FFA0000-0x0000026B9FFCB000-memory.dmp

Filesize
172KB

Download
memory/948-130-0x00007FF87808C000-0x00007FF87808D000-memory.dmp

Filesize
4KB

Download
memory/1020-113-0x0000013FAB020000-0x0000013FAB04B000-memory.dmp

Filesize
172KB

Download
memory/1020-128-0x0000013FAB020000-0x0000013FAB04B000-memory.dmp

Filesize
172KB

Download
memory/1120-141-0x00000161E97D0000-0x00000161E97FB000-memory.dmp

Filesize
172KB

Download
memory/1120-147-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/1120-149-0x00000161E97D0000-0x00000161E97FB000-memory.dmp

Filesize
172KB

Download
memory/1140-154-0x000002A4BB090000-0x000002A4BB0BB000-memory.dmp

Filesize
172KB

Download
memory/1140-148-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/1140-143-0x000002A4BB090000-0x000002A4BB0BB000-memory.dmp

Filesize
172KB

Download
memory/1148-160-0x000001FAB6600000-0x000001FAB662B000-memory.dmp

Filesize
172KB

Download
memory/1148-156-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/1148-150-0x000001FAB6600000-0x000001FAB662B000-memory.dmp

Filesize
172KB

Download
memory/1156-158-0x000001C612D70000-0x000001C612D9B000-memory.dmp

Filesize
172KB

Download
memory/1156-155-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/1156-151-0x000001C612D70000-0x000001C612D9B000-memory.dmp

Filesize
172KB

Download
memory/1224-177-0x00007FF838070000-0x00007FF838080000-memory.dmp

Filesize
64KB

Download
memory/1224-176-0x000002AF011A0000-0x000002AF011CB000-memory.dmp

Filesize
172KB

Download
memory/1304-182-0x000001D899C90000-0x000001D899CBB000-memory.dmp

Filesize
172KB

Download
memory/1304-189-0x000001D899C90000-0x000001D899CBB000-memory.dmp

Filesize
172KB

Download
memory/1336-192-0x00000183E4790000-0x00000183E47BB000-memory.dmp

Filesize
172KB

Download
memory/1556-87-0x00007FF857A30000-0x00007FF8584F1000-memory.dmp

Filesize
10.8MB

Download
memory/1556-84-0x00000160411D0000-0x00000160411E0000-memory.dmp

Filesize
64KB

Download
memory/1556-81-0x00000160411D0000-0x00000160411E0000-memory.dmp

Filesize
64KB

Download
memory/1556-82-0x0000016028A40000-0x0000016028A62000-memory.dmp

Filesize
136KB

Download
memory/1556-77-0x00000160411D0000-0x00000160411E0000-memory.dmp

Filesize
64KB

Download
memory/1556-76-0x00007FF857A30000-0x00007FF8584F1000-memory.dmp

Filesize
10.8MB

Download
memory/2712-64-0x0000000007580000-0x0000000007594000-memory.dmp

Filesize
80KB

Download
memory/2712-61-0x00000000075C0000-0x0000000007656000-memory.dmp

Filesize
600KB

Download
memory/2712-58-0x0000000007980000-0x0000000007FFA000-memory.dmp

Filesize
6.5MB

Download
memory/2712-57-0x0000000007020000-0x00000000070C3000-memory.dmp

Filesize
652KB

Download
memory/2712-56-0x00000000065E0000-0x00000000065FE000-memory.dmp

Filesize
120KB

Download
memory/2712-46-0x0000000074C10000-0x0000000074C5C000-memory.dmp

Filesize
304KB

Download
memory/2712-45-0x0000000006FE0000-0x0000000007012000-memory.dmp

Filesize
200KB

Download
memory/2712-44-0x000000007FD90000-0x000000007FDA0000-memory.dmp

Filesize
64KB

Download
memory/2712-42-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/2712-41-0x0000000006050000-0x000000000609C000-memory.dmp

Filesize
304KB

Download
memory/2712-40-0x0000000006030000-0x000000000604E000-memory.dmp

Filesize
120KB

Download
memory/2712-35-0x0000000005A20000-0x0000000005D74000-memory.dmp

Filesize
3.3MB

Download
memory/2712-27-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/2712-29-0x00000000059B0000-0x0000000005A16000-memory.dmp

Filesize
408KB

Download
memory/2712-28-0x0000000005940000-0x00000000059A6000-memory.dmp

Filesize
408KB

Download
memory/2712-25-0x0000000005040000-0x0000000005062000-memory.dmp

Filesize
136KB

Download
memory/2712-66-0x00000000075B0000-0x00000000075B8000-memory.dmp

Filesize
32KB

Download
memory/2712-19-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/2712-20-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/2712-65-0x0000000007660000-0x000000000767A000-memory.dmp

Filesize
104KB

Download
memory/2712-23-0x00000000052A0000-0x00000000058C8000-memory.dmp

Filesize
6.2MB

Download
memory/2712-69-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/2712-63-0x0000000007570000-0x000000000757E000-memory.dmp

Filesize
56KB

Download
memory/2712-22-0x0000000002700000-0x0000000002736000-memory.dmp

Filesize
216KB

Download
memory/2712-60-0x00000000073B0000-0x00000000073BA000-memory.dmp

Filesize
40KB

Download
memory/2712-59-0x0000000007330000-0x000000000734A000-memory.dmp

Filesize
104KB

Download
memory/2712-62-0x0000000007530000-0x0000000007541000-memory.dmp

Filesize
68KB

Download
memory/2908-133-0x0000026B4C130000-0x0000026B4C140000-memory.dmp

Filesize
64KB

Download
memory/2908-142-0x00007FF857A30000-0x00007FF8584F1000-memory.dmp

Filesize
10.8MB

Download
memory/2908-211-0x0000026B4C740000-0x0000026B4C75C000-memory.dmp

Filesize
112KB

Download
memory/2908-210-0x0000026B4C2F0000-0x0000026B4C2FA000-memory.dmp

Filesize
40KB

Download
memory/2908-209-0x0000026B4C520000-0x0000026B4C5D5000-memory.dmp

Filesize
724KB

Download
memory/2908-208-0x0000026B4C500000-0x0000026B4C51C000-memory.dmp

Filesize
112KB

Download
memory/2908-207-0x00007FF4273B0000-0x00007FF4273C0000-memory.dmp

Filesize
64KB

Download
memory/2908-186-0x0000026B4C130000-0x0000026B4C140000-memory.dmp

Filesize
64KB

Download
memory/4608-92-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4608-96-0x00007FF877020000-0x00007FF8770DE000-memory.dmp

Filesize
760KB

Download
memory/4608-98-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4608-94-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4608-95-0x00007FF877FF0000-0x00007FF8781E5000-memory.dmp

Filesize
2.0MB

Download
memory/4608-91-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4608-90-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4608-89-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5036-26-0x00000114245E0000-0x00000114245F0000-memory.dmp

Filesize
64KB

Download
memory/5036-188-0x00007FF857A30000-0x00007FF8584F1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-135-0x00000114245E0000-0x00000114245F0000-memory.dmp

Filesize
64KB

Download
memory/5036-110-0x00007FF857A30000-0x00007FF8584F1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-24-0x00007FF857A30000-0x00007FF8584F1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-21-0x0000011424190000-0x00000114241A2000-memory.dmp

Filesize
72KB

Download