Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-05-2024 18:17

General

  • Target

    miner.TMP/jhi_service.exe

  • Size

    2.5MB

  • MD5

    1994ad04639f3d12c7bbfa37feb3434f

  • SHA1

    4979247e5a9771286a91827851527e5dbfb80c8e

  • SHA256

    c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c

  • SHA512

    adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43

  • SSDEEP

    49152:JeyI4v7SO1chT1kPoGyH22x8wfc3QC/FGQAC8TnWhVpihDHdggjrKCnQPzkwG:JtjehT1kA4wXGMRyk7Kg/nnY

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe
    "C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4628
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:944
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4928
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4708
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2764
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "HDNFMUHS"
      2⤵
      • Launches sc.exe
      PID:2796
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"
      2⤵
      • Launches sc.exe
      PID:3736
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      2⤵
      • Launches sc.exe
      PID:4936
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "HDNFMUHS"
      2⤵
      • Launches sc.exe
      PID:3088
  • C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe
    C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1832
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3108
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3892
    • C:\Windows\system32\conhost.exe
      C:\Windows\system32\conhost.exe
      2⤵
        PID:4816
      • C:\Windows\system32\svchost.exe
        svchost.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4100

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

      Filesize

      2.5MB

      MD5

      1994ad04639f3d12c7bbfa37feb3434f

      SHA1

      4979247e5a9771286a91827851527e5dbfb80c8e

      SHA256

      c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c

      SHA512

      adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43

    • memory/4100-20-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-17-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-16-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-14-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-18-0x00000267BA1A0000-0x00000267BA1C0000-memory.dmp

      Filesize

      128KB

    • memory/4100-19-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-21-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-22-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-23-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-25-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-13-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-11-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-15-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-12-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4100-24-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/4816-6-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/4816-5-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/4816-4-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/4816-3-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/4816-7-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB

    • memory/4816-10-0x0000000140000000-0x000000014000D000-memory.dmp

      Filesize

      52KB