Overview
overview
10Static
static
10CriticalFiles/SN.dll
windows7-x64
1CriticalFiles/SN.dll
windows10-2004-x64
1CriticalFi...er.exe
windows7-x64
10CriticalFi...er.exe
windows10-2004-x64
10CriticalFi...SN.exe
windows7-x64
7CriticalFi...SN.exe
windows10-2004-x64
8InstHndl.dll
windows7-x64
1InstHndl.dll
windows10-2004-x64
1SuperNova.exe
windows7-x64
1SuperNova.exe
windows10-2004-x64
10Analysis
-
max time kernel
111s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 13:18
Behavioral task
behavioral1
Sample
CriticalFiles/SN.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
CriticalFiles/SN.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
CriticalFiles/SNInstallerHandler.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
CriticalFiles/SNInstallerHandler.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
CriticalFiles/StageSN.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
CriticalFiles/StageSN.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
InstHndl.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
InstHndl.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
SuperNova.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
SuperNova.exe
Resource
win10v2004-20240611-en
General
-
Target
CriticalFiles/SNInstallerHandler.exe
-
Size
2.5MB
-
MD5
962b890f95429f93e9e56f35d3208e59
-
SHA1
a98559becdf6981f7335666418d5f35eef3bae34
-
SHA256
2a97972bc0c3af489e1b551b995c198444785d5007930b6d0de8e6d5d025e868
-
SHA512
e5aff298bd48e1c686ec527d3bf40f0a85e584ab0807c749b862f133171ab38835bfe95ba1d64ec2ece019d7f1fe64dbe5c7fa4685ab614a180fd61070acc8af
-
SSDEEP
49152:OCC81n43bykG2YFwoFV5LDo25gixiDX5cde4UJkDDtCbPGGG:OCB1sGkG2uwoFbLFeX50LUJkUDGG
Malware Config
Signatures
-
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral3/memory/944-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-43-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-42-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/944-44-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2344 powershell.exe 764 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
CoinService.exepid process 480 1192 CoinService.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 480 -
Processes:
resource yara_rule behavioral3/memory/944-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-41-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-43-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-42-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/944-44-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepid process 2324 powercfg.exe 1580 powercfg.exe 2672 powercfg.exe 2548 powercfg.exe 1252 powercfg.exe 3048 powercfg.exe 3028 powercfg.exe 2368 powercfg.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exeSNInstallerHandler.exepowershell.exeCoinService.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe SNInstallerHandler.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe CoinService.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
CoinService.exedescription pid process target process PID 1192 set thread context of 1936 1192 CoinService.exe conhost.exe PID 1192 set thread context of 944 1192 CoinService.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
wusa.exewusa.exedescription ioc process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2732 sc.exe 2860 sc.exe 1644 sc.exe 2848 sc.exe 2632 sc.exe 3032 sc.exe 2652 sc.exe 2392 sc.exe 2684 sc.exe 2780 sc.exe 3004 sc.exe 2768 sc.exe 2500 sc.exe 2812 sc.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
explorer.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 7093cc3695c8da01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SNInstallerHandler.exepowershell.exeCoinService.exepowershell.exeexplorer.exepid process 1096 SNInstallerHandler.exe 2344 powershell.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1096 SNInstallerHandler.exe 1192 CoinService.exe 764 powershell.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 1192 CoinService.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe 944 explorer.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2344 powershell.exe Token: SeShutdownPrivilege 1252 powercfg.exe Token: SeShutdownPrivilege 1580 powercfg.exe Token: SeShutdownPrivilege 2548 powercfg.exe Token: SeShutdownPrivilege 2672 powercfg.exe Token: SeDebugPrivilege 764 powershell.exe Token: SeShutdownPrivilege 2324 powercfg.exe Token: SeShutdownPrivilege 2368 powercfg.exe Token: SeShutdownPrivilege 3028 powercfg.exe Token: SeShutdownPrivilege 3048 powercfg.exe Token: SeLockMemoryPrivilege 944 explorer.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.execmd.exeCoinService.exedescription pid process target process PID 2616 wrote to memory of 2728 2616 cmd.exe wusa.exe PID 2616 wrote to memory of 2728 2616 cmd.exe wusa.exe PID 2616 wrote to memory of 2728 2616 cmd.exe wusa.exe PID 2992 wrote to memory of 2804 2992 cmd.exe wusa.exe PID 2992 wrote to memory of 2804 2992 cmd.exe wusa.exe PID 2992 wrote to memory of 2804 2992 cmd.exe wusa.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 1936 1192 CoinService.exe conhost.exe PID 1192 wrote to memory of 944 1192 CoinService.exe explorer.exe PID 1192 wrote to memory of 944 1192 CoinService.exe explorer.exe PID 1192 wrote to memory of 944 1192 CoinService.exe explorer.exe PID 1192 wrote to memory of 944 1192 CoinService.exe explorer.exe PID 1192 wrote to memory of 944 1192 CoinService.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CriticalFiles\SNInstallerHandler.exe"C:\Users\Admin\AppData\Local\Temp\CriticalFiles\SNInstallerHandler.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1096 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2728 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2652 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2732 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2632 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2768 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2860 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2672 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2548 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "Microsoft"2⤵
- Launches sc.exe
PID:2500 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "Microsoft" binpath= "C:\ProgramData\Non-Delete-Critical-files\CoinService.exe" start= "auto"2⤵
- Launches sc.exe
PID:2392 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1644 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "Microsoft"2⤵
- Launches sc.exe
PID:2684
-
C:\ProgramData\Non-Delete-Critical-files\CoinService.exeC:\ProgramData\Non-Delete-Critical-files\CoinService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2804 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3032 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2780 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2812 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2848 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3004 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3028 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2368 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1936
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5962b890f95429f93e9e56f35d3208e59
SHA1a98559becdf6981f7335666418d5f35eef3bae34
SHA2562a97972bc0c3af489e1b551b995c198444785d5007930b6d0de8e6d5d025e868
SHA512e5aff298bd48e1c686ec527d3bf40f0a85e584ab0807c749b862f133171ab38835bfe95ba1d64ec2ece019d7f1fe64dbe5c7fa4685ab614a180fd61070acc8af