Analysis

  • max time kernel
    111s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 13:18

General

  • Target

    CriticalFiles/SNInstallerHandler.exe

  • Size

    2.5MB

  • MD5

    962b890f95429f93e9e56f35d3208e59

  • SHA1

    a98559becdf6981f7335666418d5f35eef3bae34

  • SHA256

    2a97972bc0c3af489e1b551b995c198444785d5007930b6d0de8e6d5d025e868

  • SHA512

    e5aff298bd48e1c686ec527d3bf40f0a85e584ab0807c749b862f133171ab38835bfe95ba1d64ec2ece019d7f1fe64dbe5c7fa4685ab614a180fd61070acc8af

  • SSDEEP

    49152:OCC81n43bykG2YFwoFV5LDo25gixiDX5cde4UJkDDtCbPGGG:OCB1sGkG2uwoFbLFeX50LUJkUDGG

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 12 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CriticalFiles\SNInstallerHandler.exe
    "C:\Users\Admin\AppData\Local\Temp\CriticalFiles\SNInstallerHandler.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1096
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2344
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Drops file in Windows directory
        PID:2728
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      2⤵
      • Launches sc.exe
      PID:2652
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      2⤵
      • Launches sc.exe
      PID:2732
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      2⤵
      • Launches sc.exe
      PID:2632
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      2⤵
      • Launches sc.exe
      PID:2768
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      2⤵
      • Launches sc.exe
      PID:2860
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:1580
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:1252
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2548
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "Microsoft"
      2⤵
      • Launches sc.exe
      PID:2500
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "Microsoft" binpath= "C:\ProgramData\Non-Delete-Critical-files\CoinService.exe" start= "auto"
      2⤵
      • Launches sc.exe
      PID:2392
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      2⤵
      • Launches sc.exe
      PID:1644
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "Microsoft"
      2⤵
      • Launches sc.exe
      PID:2684
  • C:\ProgramData\Non-Delete-Critical-files\CoinService.exe
    C:\ProgramData\Non-Delete-Critical-files\CoinService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:764
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Drops file in Windows directory
        PID:2804
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      2⤵
      • Launches sc.exe
      PID:3032
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      2⤵
      • Launches sc.exe
      PID:2780
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      2⤵
      • Launches sc.exe
      PID:2812
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      2⤵
      • Launches sc.exe
      PID:2848
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      2⤵
      • Launches sc.exe
      PID:3004
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:3048
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:3028
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2368
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2324
    • C:\Windows\system32\conhost.exe
      C:\Windows\system32\conhost.exe
      2⤵
        PID:1936
      • C:\Windows\explorer.exe
        explorer.exe
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \ProgramData\Non-Delete-Critical-files\CoinService.exe

      Filesize

      2.5MB

      MD5

      962b890f95429f93e9e56f35d3208e59

      SHA1

      a98559becdf6981f7335666418d5f35eef3bae34

      SHA256

      2a97972bc0c3af489e1b551b995c198444785d5007930b6d0de8e6d5d025e868

      SHA512

      e5aff298bd48e1c686ec527d3bf40f0a85e584ab0807c749b862f133171ab38835bfe95ba1d64ec2ece019d7f1fe64dbe5c7fa4685ab614a180fd61070acc8af

    • memory/764-17-0x0000000000A30000-0x0000000000A38000-memory.dmp

      Filesize

      32KB

    • memory/764-16-0x0000000019FD0000-0x000000001A2B2000-memory.dmp

      Filesize

      2.9MB

    • memory/944-35-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-43-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-33-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-42-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-32-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-41-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-31-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-40-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-28-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-34-0x0000000000230000-0x0000000000250000-memory.dmp

      Filesize

      128KB

    • memory/944-38-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-39-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-37-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-30-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-44-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-27-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-29-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/944-36-0x0000000140000000-0x0000000140848000-memory.dmp

      Filesize

      8.3MB

    • memory/1936-18-0x0000000140000000-0x000000014000E000-memory.dmp

      Filesize

      56KB

    • memory/1936-19-0x0000000140000000-0x000000014000E000-memory.dmp

      Filesize

      56KB

    • memory/1936-24-0x0000000140000000-0x000000014000E000-memory.dmp

      Filesize

      56KB

    • memory/1936-22-0x0000000140000000-0x000000014000E000-memory.dmp

      Filesize

      56KB

    • memory/1936-21-0x0000000140000000-0x000000014000E000-memory.dmp

      Filesize

      56KB

    • memory/1936-20-0x0000000140000000-0x000000014000E000-memory.dmp

      Filesize

      56KB

    • memory/2344-10-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-6-0x0000000002200000-0x0000000002208000-memory.dmp

      Filesize

      32KB

    • memory/2344-7-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-5-0x000000001B580000-0x000000001B862000-memory.dmp

      Filesize

      2.9MB

    • memory/2344-4-0x000007FEF583E000-0x000007FEF583F000-memory.dmp

      Filesize

      4KB

    • memory/2344-11-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-8-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

      Filesize

      9.6MB

    • memory/2344-9-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

      Filesize

      9.6MB