xmrig | 35973c5136f494996d639ab753dbbb89759fe89b73fac13505d5821587c8254c

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
Size 6.8MB
Sample240528-b5cjkabc72
SHA256 35973c5136f494996d639ab753dbbb89759fe89b73fac13505d5821587c8254c
MD5 7b46c5c2165c4b8c43c36806438ac944
SHA1 4a795e8d192cc3138de7bb310432193b14b7651b
SHA512 0ddcf7230b503ccc5c4451b71f1630f6055ae5f292702140d67d0764cd21c620d2590d9cc27fa70e0b451cd944233e313046275c53a2990f9de58da23bd9957e
SSDEEP 98304:KItBEX3icnoTNO3g3Zw9kEYj5Rv+d/JOaSjXMx6RQAHA3HGEOE12GWUcwmD6:KiiPpQJwkEYPysix6R76HJOEr7cwO6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/4052-51-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/412-59-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	xmrig
behavioral2/memory/2764-60-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	xmrig
behavioral2/memory/4052-61-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4052-62-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4052-66-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4048-72-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	xmrig
behavioral2/memory/2744-74-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	xmrig
behavioral2/memory/4052-75-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4052-79-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/3060-85-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	xmrig
behavioral2/memory/384-88-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	xmrig
behavioral2/memory/4052-89-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4052-93-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/3564-99-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	xmrig
behavioral2/memory/1040-102-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	xmrig
behavioral2/memory/4052-103-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4052-107-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4336-112-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	xmrig
behavioral2/memory/1880-115-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	xmrig
behavioral2/memory/4052-116-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4052-120-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/3476-126-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	xmrig
behavioral2/memory/3776-128-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	xmrig
behavioral2/memory/4052-129-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig
behavioral2/memory/4052-133-0x0000000000400000-0x0000000000507000-memory.dmp	xmrig

Sets file to hidden 1 TTPs 10 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4140	attrib.exe
5112	attrib.exe
636	attrib.exe
4400	attrib.exe
2396	attrib.exe
5108	attrib.exe
776	attrib.exe
4828	attrib.exe
5056	attrib.exe
3208	attrib.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	EsetGui.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	winclip.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	winscreen.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EsetGui.exe.lnk	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe

Executes dropped EXE 19 IoCs

pid	Process
4940	EsetGui.exe
5092	winclip.exe
4864	update.exe
3668	winscreen.exe
4052	System32.exe
2764	NVDisplay.exe
412	NiceSrv.exe
4048	NVDisplay.exe
2744	NiceSrv.exe
3060	NVDisplay.exe
384	NiceSrv.exe
3564	NVDisplay.exe
1040	NiceSrv.exe
4336	NVDisplay.exe
1880	NiceSrv.exe
3476	NVDisplay.exe
3776	NiceSrv.exe
4604	NVDisplay.exe
676	NiceSrv.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023435-31.dat	upx
behavioral2/files/0x0007000000023434-32.dat	upx
behavioral2/files/0x0007000000023433-33.dat	upx
behavioral2/files/0x0007000000023437-36.dat	upx
behavioral2/files/0x0007000000023438-38.dat	upx
behavioral2/memory/3668-44-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4864-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/files/0x0007000000023436-41.dat	upx
behavioral2/memory/5092-40-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4052-47-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/5092-48-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4864-49-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3668-50-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4052-51-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/2764-56-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	upx
behavioral2/memory/412-58-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	upx
behavioral2/memory/412-59-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	upx
behavioral2/memory/2764-60-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	upx
behavioral2/memory/4052-61-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4052-62-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4052-66-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4048-72-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	upx
behavioral2/memory/2744-74-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	upx
behavioral2/memory/4052-75-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4052-79-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/3060-85-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	upx
behavioral2/memory/384-88-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	upx
behavioral2/memory/4052-89-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4052-93-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/3564-99-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	upx
behavioral2/memory/1040-102-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	upx
behavioral2/memory/4052-103-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4052-107-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4336-112-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	upx
behavioral2/memory/1880-115-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	upx
behavioral2/memory/4052-116-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4052-120-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/3476-126-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp	upx
behavioral2/memory/3776-128-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp	upx
behavioral2/memory/4052-129-0x0000000000400000-0x0000000000507000-memory.dmp	upx
behavioral2/memory/4052-133-0x0000000000400000-0x0000000000507000-memory.dmp	upx

Drops file in System32 directory 39 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\update.vbs	update.exe
File created	C:\Windows\SysWOW64\NVDisplay.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config.json	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NVDisplay.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bmc.json	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\EsetGui.vbs	EsetGui.exe
File created	C:\Windows\SysWOW64\__tmp_rar_sfx_access_check_240604218	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bmc.json	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\System32.bat	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EsetGui.vbs	EsetGui.exe
File opened for modification	C:\Windows\SysWOW64\NVDisplay.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\update.vbs	update.exe
File created	C:\Windows\SysWOW64\update.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\System32.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winclip.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winscreen.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\System32.bat	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winscreen.vbs	winscreen.exe
File created	C:\Windows\SysWOW64\System32.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NiceSrv.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\update.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winscreen.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\winclip.vbs	winclip.exe
File created	C:\Windows\SysWOW64\winscreen.vbs	winscreen.exe
File created	C:\Windows\SysWOW64\NiceSrv.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winclip.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winclip.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\EsetGui.exe	attrib.exe
File created	C:\Windows\SysWOW64\winclip.vbs	winclip.exe
File opened for modification	C:\Windows\SysWOW64\EsetGui.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EsetGui.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\System32.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\NiceSrv.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\config.json	attrib.exe
File opened for modification	C:\Windows\SysWOW64\update.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\config.json	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bmc.json	attrib.exe
File opened for modification	C:\Windows\SysWOW64\System32.bat	attrib.exe
File created	C:\Windows\SysWOW64\winscreen.exe	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winclip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winscreen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4052	System32.exe
Token: SeLockMemoryPrivilege	4052	System32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 4940	60	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe	82
PID 60 wrote to memory of 4940	60	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe	82
PID 60 wrote to memory of 4940	60	7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe	82
PID 4940 wrote to memory of 3536	4940	EsetGui.exe	86
PID 4940 wrote to memory of 3536	4940	EsetGui.exe	86
PID 4940 wrote to memory of 3536	4940	EsetGui.exe	86
PID 3536 wrote to memory of 636	3536	cmd.exe	88
PID 3536 wrote to memory of 636	3536	cmd.exe	88
PID 3536 wrote to memory of 636	3536	cmd.exe	88
PID 3536 wrote to memory of 4400	3536	cmd.exe	89
PID 3536 wrote to memory of 4400	3536	cmd.exe	89
PID 3536 wrote to memory of 4400	3536	cmd.exe	89
PID 3536 wrote to memory of 5056	3536	cmd.exe	90
PID 3536 wrote to memory of 5056	3536	cmd.exe	90
PID 3536 wrote to memory of 5056	3536	cmd.exe	90
PID 3536 wrote to memory of 2396	3536	cmd.exe	92
PID 3536 wrote to memory of 2396	3536	cmd.exe	92
PID 3536 wrote to memory of 2396	3536	cmd.exe	92
PID 3536 wrote to memory of 4140	3536	cmd.exe	93
PID 3536 wrote to memory of 4140	3536	cmd.exe	93
PID 3536 wrote to memory of 4140	3536	cmd.exe	93
PID 3536 wrote to memory of 4828	3536	cmd.exe	94
PID 3536 wrote to memory of 4828	3536	cmd.exe	94
PID 3536 wrote to memory of 4828	3536	cmd.exe	94
PID 3536 wrote to memory of 5108	3536	cmd.exe	95
PID 3536 wrote to memory of 5108	3536	cmd.exe	95
PID 3536 wrote to memory of 5108	3536	cmd.exe	95
PID 3536 wrote to memory of 776	3536	cmd.exe	96
PID 3536 wrote to memory of 776	3536	cmd.exe	96
PID 3536 wrote to memory of 776	3536	cmd.exe	96
PID 3536 wrote to memory of 5112	3536	cmd.exe	97
PID 3536 wrote to memory of 5112	3536	cmd.exe	97
PID 3536 wrote to memory of 5112	3536	cmd.exe	97
PID 3536 wrote to memory of 3208	3536	cmd.exe	98
PID 3536 wrote to memory of 3208	3536	cmd.exe	98
PID 3536 wrote to memory of 3208	3536	cmd.exe	98
PID 3536 wrote to memory of 5092	3536	cmd.exe	99
PID 3536 wrote to memory of 5092	3536	cmd.exe	99
PID 3536 wrote to memory of 5092	3536	cmd.exe	99
PID 3536 wrote to memory of 4864	3536	cmd.exe	100
PID 3536 wrote to memory of 4864	3536	cmd.exe	100
PID 3536 wrote to memory of 4864	3536	cmd.exe	100
PID 3536 wrote to memory of 3668	3536	cmd.exe	101
PID 3536 wrote to memory of 3668	3536	cmd.exe	101
PID 3536 wrote to memory of 3668	3536	cmd.exe	101
PID 5092 wrote to memory of 4052	5092	winclip.exe	108
PID 5092 wrote to memory of 4052	5092	winclip.exe	108
PID 5092 wrote to memory of 4052	5092	winclip.exe	108
PID 4864 wrote to memory of 2764	4864	update.exe	113
PID 4864 wrote to memory of 2764	4864	update.exe	113
PID 3668 wrote to memory of 412	3668	winscreen.exe	115
PID 3668 wrote to memory of 412	3668	winscreen.exe	115
PID 4864 wrote to memory of 4048	4864	update.exe	119
PID 4864 wrote to memory of 4048	4864	update.exe	119
PID 3668 wrote to memory of 2744	3668	winscreen.exe	121
PID 3668 wrote to memory of 2744	3668	winscreen.exe	121
PID 4864 wrote to memory of 3060	4864	update.exe	123
PID 4864 wrote to memory of 3060	4864	update.exe	123
PID 3668 wrote to memory of 384	3668	winscreen.exe	125
PID 3668 wrote to memory of 384	3668	winscreen.exe	125
PID 4864 wrote to memory of 3564	4864	update.exe	128
PID 4864 wrote to memory of 3564	4864	update.exe	128
PID 3668 wrote to memory of 1040	3668	winscreen.exe	130
PID 3668 wrote to memory of 1040	3668	winscreen.exe	130

Views/modifies file attributes 1 TTPs 10 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4828	attrib.exe
4140	attrib.exe
3208	attrib.exe
636	attrib.exe
4400	attrib.exe
5056	attrib.exe
5108	attrib.exe
776	attrib.exe
2396	attrib.exe
5112	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7b46c5c2165c4b8c43c36806438ac944_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\SysWOW64\EsetGui.exe
  "C:\Windows\System32\EsetGui.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\System32.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H System32.exe
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H NVDisplay.exe
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:4400
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H NiceSrv.exe
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:5056
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H config.json
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:2396
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H bmc.json
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:4140
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H System32.bat
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:4828
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H winclip.exe
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:5108
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H update.exe
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:776
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H winscreen.exe
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:5112
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +R +S +H EsetGui.exe
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:3208
  - - C:\Windows\SysWOW64\winclip.exe
      winclip.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Windows\SysWOW64\System32.exe
        
        "C:\Windows\System32\System32.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
  - - C:\Windows\SysWOW64\update.exe
      update.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\SysWOW64\NVDisplay.exe
        
        "C:\Windows\System32\NVDisplay.exe"
        5⤵
        Executes dropped EXE
        
        PID:2764
    - - C:\Windows\SysWOW64\NVDisplay.exe
        
        "C:\Windows\System32\NVDisplay.exe"
        5⤵
        Executes dropped EXE
        
        PID:4048
    - - C:\Windows\SysWOW64\NVDisplay.exe
        
        "C:\Windows\System32\NVDisplay.exe"
        5⤵
        Executes dropped EXE
        
        PID:3060
    - - C:\Windows\SysWOW64\NVDisplay.exe
        
        "C:\Windows\System32\NVDisplay.exe"
        5⤵
        Executes dropped EXE
        
        PID:3564
    - - C:\Windows\SysWOW64\NVDisplay.exe
        
        "C:\Windows\System32\NVDisplay.exe"
        5⤵
        Executes dropped EXE
        
        PID:4336
    - - C:\Windows\SysWOW64\NVDisplay.exe
        
        "C:\Windows\System32\NVDisplay.exe"
        5⤵
        Executes dropped EXE
        
        PID:3476
    - - C:\Windows\SysWOW64\NVDisplay.exe
        
        "C:\Windows\System32\NVDisplay.exe"
        5⤵
        Executes dropped EXE
        
        PID:4604
  - - C:\Windows\SysWOW64\winscreen.exe
      winscreen.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3668
    - - C:\Windows\SysWOW64\NiceSrv.exe
        
        "C:\Windows\System32\NiceSrv.exe"
        5⤵
        Executes dropped EXE
        
        PID:412
    - - C:\Windows\SysWOW64\NiceSrv.exe
        
        "C:\Windows\System32\NiceSrv.exe"
        5⤵
        Executes dropped EXE
        
        PID:2744
    - - C:\Windows\SysWOW64\NiceSrv.exe
        
        "C:\Windows\System32\NiceSrv.exe"
        5⤵
        Executes dropped EXE
        
        PID:384
    - - C:\Windows\SysWOW64\NiceSrv.exe
        
        "C:\Windows\System32\NiceSrv.exe"
        5⤵
        Executes dropped EXE
        
        PID:1040
    - - C:\Windows\SysWOW64\NiceSrv.exe
        
        "C:\Windows\System32\NiceSrv.exe"
        5⤵
        Executes dropped EXE
        
        PID:1880
    - - C:\Windows\SysWOW64\NiceSrv.exe
        
        "C:\Windows\System32\NiceSrv.exe"
        5⤵
        Executes dropped EXE
        
        PID:3776
    - - C:\Windows\SysWOW64\NiceSrv.exe
        
        "C:\Windows\System32\NiceSrv.exe"
        5⤵
        Executes dropped EXE
        
        PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetGui.exe

Path C:\Windows\SysWOW64\EsetGui.exe
Size 80KB
SHA256 e63ef427cde4a8c2f9740b800989a1dab8c970d74083cb4b85c4c71d760d0d95
MD5 d0d4868b55e63c1f5a963e105c46650e
SHA1 890a882b82f116013a9d26e9ef15da7c441e96e7
SHA512 4bcbaf29089a3031da4501a9d0f455251a829b6a4bf462cf79d20d3cc7c80351392ac40a84edc09235ff5c63fcb0c2dc05cdd18744c27f2fa3ecd911ef197108
SSDEEP 1536:MeAZLLL1GXAQ5kBOWY94bgvGi+bNLkB84jU7J/cxtPZl:xQBB0+bNLu8FJ/SlZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

NVDisplay.exe

Path C:\Windows\SysWOW64\NVDisplay.exe
Size 2.8MB
SHA256 8011e1cf77eef8d5b412d43ab329f784cb171b08b5de32e1fc230f5ed9522c44
MD5 04359d97fb82b89e3ffdf0d621ba771f
SHA1 855514e16f7e72b327dfd7218f15d8591a0590f7
SHA512 36e2d849adab11669698548dc1b1e75ff22407208e5c50dc56118cb92df467ab0e99f110802ac9b33613b10afbb225900257ac13d6d277556715a14000e3a3a7
SSDEEP 49152:DFwvFmi4vGoxanLhPn4+bKoSM3vOV5OAdcN+BObyBFn9u+glKR/4iu+dHvJgm+VM:DFwNj3VP4+bKoZwzWXyj9u1cT7Hv5+V3
MD5 SHA1 SHA512 SSDEEP

Submit Download

NiceSrv.exe

Path C:\Windows\SysWOW64\NiceSrv.exe
Size 3.5MB
SHA256 3a2971a268c241012ca11c60be59f101b9476284d1662c6a568164ae9541df69
MD5 c52ea40fb6a8b23627ad3c673c3a6466
SHA1 f57e5d39ad1eaf976def0c15a6ccc8b555301051
SHA512 4c1fd55a7f358e0ec4610664ddd1afa4fe8adbac02346da10003b63861d258cbe616d9cbab704ee1416072b96ad5fee0ca2302168364c626cf7b08a6fdbce0db
SSDEEP 98304:B3DXEHOkEtv+7UVQDgh5PhX4RrrE7pXBvahtD1u8lQ/d:JDPk7KZ4u5aYcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

System32.bat

Path C:\Windows\SysWOW64\System32.bat
Size 3KB
SHA256 ba8ec75a495baf063814a4d6658e434307dd5c1dda6daa61da6f21bd3df4686d
MD5 9192b42113cc9ce3be3e300f64ab47f8
SHA1 a8c7f566bb063cb9a7bb4482f4d95962a81d8ff0
SHA512 b05514f9c3a6f12e2c1e77c6be8526b99631a14183234322077729d14bae0f0fac03f35e33196ab62397f1cb38fdcaeec3ea8009f22ca42c4fc9d251351e59d3
MD5 SHA1 SHA512

Submit Download

System32.exe

Path C:\Windows\SysWOW64\System32.exe
Size 367KB
SHA256 5c26e2e9a0dd4c85ea8f23a1872d98e2bec8506e3c7de57445fe8d22733f595d
MD5 57cce0293af002de175a89041c9a05ca
SHA1 d97101fbbc7623a1dfe18577f265953a35c47ec2
SHA512 9dc71ca07e9d634263d2207621ef0859644aabfd845c12ec275d5153f15f0ff1d76ff3c87546701d3ce9b0c0b324ab288f34c771afa0c238d5a9ec1a3ff8cfae
SSDEEP 6144:1xXHgO6xvFhR92r0j8zZWYwhNIapI4NhfW4Vrh1P/A9ZscWGB2FY9mLPZCOvmF:1xX8dX8zZWV/lW48Z3np9chC3
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmc.json

Path C:\Windows\SysWOW64\bmc.json
Size 198B
SHA256 90a5eda340703c58ad828354ba982eae5f8c471053fc2e7d37c5f01337090109
MD5 c90303b30ed01977541f993ce2f039d3
SHA1 a2798d85409c4eb3645002f230ed99b218713888
SHA512 c4eb0f3f91d7e03c072d4587373ad6446280714b1b0f418a23e68ee0ac33136d44d468216df50d3c45c032621a80406d5eeda57e0c3eca6777bbb65f17da75cb
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Windows\SysWOW64\config.json
Size 737B
SHA256 c2c877c32971d2dd16abe32ec899fa5729068ffa6428aa102b7ead4d5a8f69d2
MD5 23c8fc339d738b441e1b971e144a2d09
SHA1 113d83ceb88115fd76b53867867fbb14340acceb
SHA512 fc393e94cfb023f56c16799fddc953193716eabfc379fd08f157cd92514358768663105773ce0f2f51efa88eeffc0c736203cd4a582ab295bb3a9b2145d740ae
MD5 SHA1 SHA512

Submit Download

update.exe

Path C:\Windows\SysWOW64\update.exe
Size 36KB
SHA256 e6e64d0f66d772fd17f36361f4437bafb9ee9f219822c65b2846032616c4229c
MD5 9954171bea5e84908b0e875e676d3ef0
SHA1 ade8d2dc4d1f721cd294c205a730366708036bf2
SHA512 52427c0cd7f4a0b3625aff98465d7e796d8c87273127cff0670934f595539aa9bd0fec3584459afbf6eef26a5912b60afd491fa7da8c70cf8af2e4c5741f7a70
SSDEEP 768:J3ip9FnCpQJKKmhcU4y9h4xqzoKnIRWjBJeyyn7taUtcxQjpo:W9JqQJnUr+xsqIkn7tPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

winclip.exe

Path C:\Windows\SysWOW64\winclip.exe
Size 36KB
SHA256 f6b0647c85541c257fc61568c7b0053cf05852b824c9c5897e084fc91d955b10
MD5 b57e465f1a7d81c4e4fe511d412e0d4b
SHA1 1ea255fbf51b19b511aae1dcf95b4669ee6ef6e4
SHA512 68fea63a132ea955b259bb1ee8ad289d25da7a0957365bf11bf9d72e429945f670bc46dc33c9a2e738318930b1967e9dc7a483b6b68be8cc9c9296878692f0a1
SSDEEP 768:JZip9FnCpQJKKmhcU4y9h4xqzoKnIRWjBJeyyns2uyr99taUtcxQjFo:s9JqQJnUr+xsqIkncyr99tP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

winscreen.exe

Path C:\Windows\SysWOW64\winscreen.exe
Size 36KB
SHA256 89dff07058f65ce58ae152030f91606a4cab541476d6f40d7550d25ac4024670
MD5 0938918d3360de9f7a4b0b0ad282861a
SHA1 e70bbab17a62b9e311531e4bdce20cbba348f1d3
SHA512 53ddc3738d3d3fd0805020a57494470e8fbfe8959b73e664e6d690a1d9dd739adaec33a53b8000068132f8d458280cabbf7a1937f795d54b0b5f6f6fa17eec35
SSDEEP 768:Juip9FnCpQJKKmhcU4y9h4xqzoKnIRWjBJeyynaDztaUtcxQjho:B9JqQJnUr+xsqIknaXtPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-88-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp

Download

memory/412-58-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp

Download

memory/412-59-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp

Download

memory/1040-102-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp

Download

memory/1880-115-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp

Download

memory/2744-74-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp

Download

memory/2764-60-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp

Download

memory/2764-56-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp

Download

memory/3060-85-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp

Download

memory/3476-126-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp

Download

memory/3564-99-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp

Download

memory/3668-50-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3668-44-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3776-128-0x00007FF7ACF00000-0x00007FF7AD74B000-memory.dmp

Download

memory/4048-72-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp

Download

memory/4052-93-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-47-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-75-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-79-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-62-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-61-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-89-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-51-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-133-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-129-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-103-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-107-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-120-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-66-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4052-116-0x0000000000400000-0x0000000000507000-memory.dmp

Download

memory/4336-112-0x00007FF7E4890000-0x00007FF7E5169000-memory.dmp

Download

memory/4864-42-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4864-49-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5092-40-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5092-48-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads