Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 18:54
Static task
static1
Behavioral task
behavioral1
Sample
07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe
Resource
win7-20240611-en
windows7-x64
15 signatures
150 seconds
General
-
Target
07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe
-
Size
5.1MB
-
MD5
6873f77d09670ee96cc2ef2778e3ee5d
-
SHA1
cd45ad4e738879fb653e5bf5b4deca44aecdf88a
-
SHA256
07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589
-
SHA512
5ba1b357c9f39cc139f9f7dd3b8581b041de6f96763e4e82fba9a2fa02b31d9c4996db7bb98c95cfbaa7ed2e3b63c76ce74c001df9a8101b97b4c27647c6e72a
-
SSDEEP
98304:Pe3+ZPTVjEdQELHktz69IGel/Rt+P2kdLYP70pywaa5FooIOzJpDRHqYd+OPxU12:P8+Wbkz69PelZQ5LF6oFlpNxdRq1mcu
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 13 IoCs
resource yara_rule behavioral1/memory/2948-17-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-16-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-15-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-14-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-19-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-18-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-22-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-24-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-23-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-21-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-25-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-27-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2948-26-0x0000000140000000-0x0000000140848000-memory.dmp UPX -
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/2948-19-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2948-18-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2948-22-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2948-24-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2948-23-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2948-21-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2948-25-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2948-27-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2948-26-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1692 powershell.exe -
resource yara_rule behavioral1/memory/2948-13-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-17-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-16-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-15-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-14-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-19-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-18-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-22-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-24-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-23-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-21-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-25-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2948-26-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2464 set thread context of 2948 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 51 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2516 sc.exe 2680 sc.exe 2504 sc.exe 1856 sc.exe 2576 sc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 1692 powershell.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1692 powershell.exe Token: SeShutdownPrivilege 2392 powercfg.exe Token: SeShutdownPrivilege 2400 powercfg.exe Token: SeShutdownPrivilege 2304 powercfg.exe Token: SeShutdownPrivilege 2384 powercfg.exe Token: SeLockMemoryPrivilege 2948 conhost.exe Token: SeLockMemoryPrivilege 2948 conhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe 2948 conhost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2512 2656 cmd.exe 36 PID 2656 wrote to memory of 2512 2656 cmd.exe 36 PID 2656 wrote to memory of 2512 2656 cmd.exe 36 PID 2464 wrote to memory of 2948 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 51 PID 2464 wrote to memory of 2948 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 51 PID 2464 wrote to memory of 2948 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 51 PID 2464 wrote to memory of 2948 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 51 PID 2464 wrote to memory of 2948 2464 07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe"C:\Users\Admin\AppData\Local\Temp\07ee73fe2a3e1ae7efc1eeddc4ac14bf884c70e4335a2b3db8ea80a19cd54589.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2512
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2680
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2504
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1856
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2576
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2516
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2948
-