Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 11:06
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
4.2MB
-
MD5
b868f691271c55662fddf5d732bd07e5
-
SHA1
b10e9c0135144a0c99122631c6422a2cdf39c8d4
-
SHA256
4ebb2bd75c78469bc1a92b5fe5086efd4712d0d28c50011d3df0631c518a44c1
-
SHA512
4eff9d4537e92b85e129c018635ae469abe1acd562ab7a081c14192fb768e7fd2402bc8db338eeb753b1c9dbc5decb3e19685e69c2a0cd2d696aa3d2c5e2bfac
-
SSDEEP
98304:uALdWXkBrMF1ET1JxfxDNcrGW6kyHaRe90A/uZunJuu9MB7wDnpFVw5Y7bR:uSTtZJT6rGWryH/90AmZnul1wsR
Malware Config
Signatures
-
XMRig Miner payload 27 IoCs
resource yara_rule behavioral2/memory/4484-17-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-16-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4616-20-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-21-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-24-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-25-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-28-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-29-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-32-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-33-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-36-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-37-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-40-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-41-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-44-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-45-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-48-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-49-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-52-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-53-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-57-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-58-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-61-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-62-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-65-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig behavioral2/memory/4484-66-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp xmrig behavioral2/memory/4616-69-0x00007FF68F760000-0x00007FF69003F000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
pid Process 4616 avgrec.exe 4484 avgrec.exe -
resource yara_rule behavioral2/memory/5004-0-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4436-1-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/files/0x000400000001db72-4.dat upx behavioral2/memory/4616-5-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-11-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/5004-14-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4436-15-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4484-17-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/4616-16-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4616-20-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-21-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/4616-24-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-25-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/5004-26-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4436-27-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4616-28-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-29-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/5004-30-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4436-31-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4616-32-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-33-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/5004-34-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4436-35-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4616-36-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-37-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/4436-39-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4616-40-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-41-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/4616-44-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-45-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/4616-48-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-49-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/5004-50-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4616-52-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-53-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/5004-55-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4436-56-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4616-57-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-58-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/5004-59-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4436-60-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4616-61-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-62-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/5004-63-0x00000000007E0000-0x0000000000FCC000-memory.dmp upx behavioral2/memory/4616-65-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-66-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx behavioral2/memory/4616-69-0x00007FF68F760000-0x00007FF69003F000-memory.dmp upx behavioral2/memory/4484-70-0x00007FF7E42E0000-0x00007FF7E4BBF000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\avgrec.exe tmp.exe -
Modifies data under HKEY_USERS 40 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates tmp.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 5004 tmp.exe 5004 tmp.exe 5004 tmp.exe 4436 tmp.exe 4436 tmp.exe 4436 tmp.exe 4436 tmp.exe 5004 tmp.exe 5004 tmp.exe 4436 tmp.exe 4436 tmp.exe 5004 tmp.exe 5004 tmp.exe 4436 tmp.exe 4436 tmp.exe 4436 tmp.exe 4436 tmp.exe 5004 tmp.exe 5004 tmp.exe 4436 tmp.exe 4436 tmp.exe 5004 tmp.exe 5004 tmp.exe 5004 tmp.exe 5004 tmp.exe 4436 tmp.exe 4436 tmp.exe 5004 tmp.exe 5004 tmp.exe 4436 tmp.exe 4436 tmp.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5004 tmp.exe Token: SeDebugPrivilege 4436 tmp.exe Token: SeLockMemoryPrivilege 4616 avgrec.exe Token: SeLockMemoryPrivilege 4616 avgrec.exe Token: SeLockMemoryPrivilege 4484 avgrec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4616 avgrec.exe 4484 avgrec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4616 5004 tmp.exe 98 PID 5004 wrote to memory of 4616 5004 tmp.exe 98 PID 4436 wrote to memory of 4484 4436 tmp.exe 100 PID 4436 wrote to memory of 4484 4436 tmp.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\avgrec.exe"" ""2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4616
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\system32\avgrec.exe"" ""2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5020 --field-trial-handle=2268,i,4334050275411101233,11484630688883830558,262144 --variations-seed-version /prefetch:81⤵PID:2856
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD53159b6de2ac0242da562e212464b5ce4
SHA13faa881b74d4e4e23d8f556a068746e74b70be11
SHA256d34086f135599c774b0078c5fa0fdf9acf3c369149f7a3d4572875290733a6ed
SHA512ed6b1f49874dafdd5787446c0ce0d8a4121e6271a5f598f09b3d3502e08e512ad5e971ba78e9c3a1e63fc60a2c423b2025c5a42eca4d21195b0e12b8a91ec7ae