Resubmissions

16/06/2024, 07:20 UTC

240616-h6f2psycpm 10

16/06/2024, 07:20 UTC

240616-h6f2psvbka 10

16/06/2024, 07:20 UTC

240616-h6f2psycpl 10

16/06/2024, 07:20 UTC

240616-h6f2psycpk 10

16/06/2024, 07:20 UTC

240616-h6f2psvbjh 10

16/06/2024, 07:20 UTC

240616-h6fqyaycnr 10

16/06/2024, 07:20 UTC

240616-h6fqyaycnq 10

16/06/2024, 07:20 UTC

240616-h6fqyaycnp 10

16/06/2024, 07:20 UTC

240616-h6fqyavbjg 10

16/06/2024, 07:20 UTC

240616-h6fqyaycnn 10

Analysis

  • max time kernel
    1798s
  • max time network
    1789s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/06/2024, 07:20 UTC

General

  • Target

    file01 - copia (13) - copia.ps1

  • Size

    462B

  • MD5

    5e2dca825bed214a14705357df13d8d6

  • SHA1

    04f20b1094e5e905bcbcdfc0f1279f6a6e2bbb9e

  • SHA256

    b45546367df23b2459a55ffa753ad4d66f8588263f87c339fb81cde87c3ffba4

  • SHA512

    70a31874a475560704829224c71d6e9f01d6dc3bfe5b1f453ff817753f7a6d1ed51249481cd14e8adae497ad6ddfbe8b4e9556556886dd97c9587b24b0701501

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 64 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\file01 - copia (13) - copia.ps1"
    1⤵
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe
      "C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe" -o gulf.moneroocean.stream:10128 -u 45aHvZ4X3ZvdhLiEiP1cjsXmSkMNoM2QFYNmXCsoTRY9h2EwjtoYcfrVpEojtmBeg5cRsY9J82Lqp6hUanQ1Dsu4UNfKxdF
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:960

Network

  • flag-us
    DNS
    github.com
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    github.com
    IN A
    Response
    github.com
    IN A
    20.26.156.215
  • flag-us
    DNS
    objects.githubusercontent.com
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    objects.githubusercontent.com
    IN A
    Response
    objects.githubusercontent.com
    IN A
    185.199.111.133
    objects.githubusercontent.com
    IN A
    185.199.109.133
    objects.githubusercontent.com
    IN A
    185.199.108.133
    objects.githubusercontent.com
    IN A
    185.199.110.133
  • flag-us
    DNS
    133.111.199.185.in-addr.arpa
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    133.111.199.185.in-addr.arpa
    IN PTR
    Response
    133.111.199.185.in-addr.arpa
    IN PTR
    cdn-185-199-111-133githubcom
  • flag-us
    DNS
    gulf.moneroocean.stream
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    gulf.moneroocean.stream
    IN A
    Response
    gulf.moneroocean.stream
    IN CNAME
    monerooceans.stream
    monerooceans.stream
    IN A
    149.102.143.109
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ctldl.windowsupdate.com
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    ctldl.windowsupdate.com.delivery.microsoft.com
    ctldl.windowsupdate.com.delivery.microsoft.com
    IN CNAME
    wu-b-net.trafficmanager.net
    wu-b-net.trafficmanager.net
    IN CNAME
    wu.azureedge.net
    wu.azureedge.net
    IN CNAME
    wu.ec.azureedge.net
    wu.ec.azureedge.net
    IN CNAME
    bg.apr-52dd2-0503.edgecastdns.net
    bg.apr-52dd2-0503.edgecastdns.net
    IN CNAME
    hlb.apr-52dd2-0.edgecastdns.net
    hlb.apr-52dd2-0.edgecastdns.net
    IN CNAME
    cs11.wpc.v0cdn.net
    cs11.wpc.v0cdn.net
    IN A
    93.184.221.240
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    109.143.102.149.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    109.143.102.149.in-addr.arpa
    IN PTR
    Response
    109.143.102.149.in-addr.arpa
    IN PTR
    vmi1690904 contaboservernet
  • flag-us
    DNS
    self.events.data.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    self.events.data.microsoft.com
    IN A
    Response
    self.events.data.microsoft.com
    IN CNAME
    self-events-data.trafficmanager.net
    self-events-data.trafficmanager.net
    IN CNAME
    onedscolprdeus08.eastus.cloudapp.azure.com
    onedscolprdeus08.eastus.cloudapp.azure.com
    IN A
    20.42.65.88
  • flag-us
    DNS
    ocsp.digicert.com
    Remote address:
    8.8.8.8:53
    Request
    ocsp.digicert.com
    IN A
    Response
    ocsp.digicert.com
    IN CNAME
    ocsp.edge.digicert.com
    ocsp.edge.digicert.com
    IN CNAME
    fp2e7a.wpc.2be4.phicdn.net
    fp2e7a.wpc.2be4.phicdn.net
    IN CNAME
    fp2e7a.wpc.phicdn.net
    fp2e7a.wpc.phicdn.net
    IN A
    192.229.221.95
  • flag-us
    DNS
    215.156.26.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    215.156.26.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
    Response
    nexusrules.officeapps.live.com
    IN CNAME
    prod.nexusrules.live.com.akadns.net
    prod.nexusrules.live.com.akadns.net
    IN A
    52.111.243.30
  • flag-us
    DNS
    88.65.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.65.42.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • 20.26.156.215:443
    github.com
    tls
    powershell.exe
    1.0kB
    8.2kB
    10
    12
  • 185.199.111.133:443
    objects.githubusercontent.com
    tls
    powershell.exe
    68.1kB
    3.9MB
    1457
    2825
  • 149.102.143.109:10128
    gulf.moneroocean.stream
    xmrig.exe
    20.3kB
    41.3kB
    200
    196
  • 8.8.8.8:53
    github.com
    dns
    powershell.exe
    488 B
    1.1kB
    7
    7

    DNS Request

    github.com

    DNS Response

    20.26.156.215

    DNS Request

    objects.githubusercontent.com

    DNS Response

    185.199.111.133
    185.199.109.133
    185.199.108.133
    185.199.110.133

    DNS Request

    133.111.199.185.in-addr.arpa

    DNS Request

    gulf.moneroocean.stream

    DNS Response

    149.102.143.109

    DNS Request

    30.243.111.52.in-addr.arpa

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    93.184.221.240

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    279 B
    568 B
    4
    4

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    109.143.102.149.in-addr.arpa

    DNS Request

    self.events.data.microsoft.com

    DNS Response

    20.42.65.88

    DNS Request

    ocsp.digicert.com

    DNS Response

    192.229.221.95

  • 8.8.8.8:53
    215.156.26.20.in-addr.arpa
    dns
    291 B
    599 B
    4
    4

    DNS Request

    215.156.26.20.in-addr.arpa

    DNS Request

    nexusrules.officeapps.live.com

    DNS Response

    52.111.243.30

    DNS Request

    88.65.42.20.in-addr.arpa

    DNS Request

    240.221.184.93.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5cvjqvif.4k5.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe

    Filesize

    9.1MB

    MD5

    205ad9eb6acd6f58752899669b69fe74

    SHA1

    bedb78ac5034259b86c2cbc915de2e861e8d7604

    SHA256

    2025f4fe930440da147eecd24a368d3a2f3c1883c499186eb429e9d662c90fda

    SHA512

    28309f453ae87e8db8c1667d8d8eee5f5f7035372c027afbec48aa3c798c53ade7cfcec0c9575cad2d108e033395ebde4fda6fcfff72c99944119f8fa91d91c3

  • memory/960-77-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-83-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-48-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-116-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-115-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-114-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-79-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-50-0x0000023C36C10000-0x0000023C36C30000-memory.dmp

    Filesize

    128KB

  • memory/960-113-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-112-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-111-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-110-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-109-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-108-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-46-0x0000023C36BA0000-0x0000023C36BC0000-memory.dmp

    Filesize

    128KB

  • memory/960-54-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-57-0x0000023C36C30000-0x0000023C36C50000-memory.dmp

    Filesize

    128KB

  • memory/960-56-0x0000023C36C10000-0x0000023C36C30000-memory.dmp

    Filesize

    128KB

  • memory/960-55-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-58-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-59-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-60-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-61-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-62-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-63-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-64-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-65-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-66-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-67-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-68-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-69-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-70-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-71-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-72-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-73-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-74-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-75-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-76-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-52-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-47-0x0000023C36BF0000-0x0000023C36C10000-memory.dmp

    Filesize

    128KB

  • memory/960-51-0x0000023C36C30000-0x0000023C36C50000-memory.dmp

    Filesize

    128KB

  • memory/960-80-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-81-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-82-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-78-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-84-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-85-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-86-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-87-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-88-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-89-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-90-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-91-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-92-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-93-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-94-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-95-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-96-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-97-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-98-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-99-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-100-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-101-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-102-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-103-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-104-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-105-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-106-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/960-107-0x00007FF7B51C0000-0x00007FF7B5DF3000-memory.dmp

    Filesize

    12.2MB

  • memory/2180-53-0x00007FFD08A93000-0x00007FFD08A95000-memory.dmp

    Filesize

    8KB

  • memory/2180-49-0x00007FFD08A90000-0x00007FFD09552000-memory.dmp

    Filesize

    10.8MB

  • memory/2180-15-0x000002195A4D0000-0x000002195A4DA000-memory.dmp

    Filesize

    40KB

  • memory/2180-14-0x000002195A5F0000-0x000002195A602000-memory.dmp

    Filesize

    72KB

  • memory/2180-12-0x00007FFD08A90000-0x00007FFD09552000-memory.dmp

    Filesize

    10.8MB

  • memory/2180-11-0x00007FFD08A90000-0x00007FFD09552000-memory.dmp

    Filesize

    10.8MB

  • memory/2180-10-0x00007FFD08A90000-0x00007FFD09552000-memory.dmp

    Filesize

    10.8MB

  • memory/2180-3-0x000002195A440000-0x000002195A462000-memory.dmp

    Filesize

    136KB

  • memory/2180-0-0x00007FFD08A93000-0x00007FFD08A95000-memory.dmp

    Filesize

    8KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.