Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
28-06-2024 13:57
General
-
Target
af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c.exe
-
Size
6.0MB
-
MD5
a20727b81b50a20483ba59ae65443dfe
-
SHA1
7429f81064e044e981de12bde015117953b7b0e7
-
SHA256
af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c
-
SHA512
c6b857207818f1e26065ac424ee5cfdb18e5297ae8c1724a5ec8e80cf96b43bcd31b479859fa863ff508030ce52c60870152b433d548df9fbfc42a378c499856
-
SSDEEP
98304:RLGSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+Y2naq8le+:YBfTCiUswVSLOJgyBG/aW+
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload 1 IoCs
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 12 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 13 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 62 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Detects Pyinstaller 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Kills process with taskkill 1 IoCs
-
Modifies data under HKEY_USERS 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c.exe"C:\Users\Admin\AppData\Local\Temp\af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c.exe"C:\Users\Admin\AppData\Local\Temp\af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /y C:\Users\Admin\AppData\Local\Temp\af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c.exe C:\Users\Admin\HelpPane.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\HelpPane.exe --startup auto install3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\HelpPane.exeC:\Users\Admin\HelpPane.exe --startup auto install4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\HelpPane.exeC:\Users\Admin\HelpPane.exe --startup auto install5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\HelpPane.exe start3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\HelpPane.exeC:\Users\Admin\HelpPane.exe start4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\HelpPane.exeC:\Users\Admin\HelpPane.exe start5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\HelpPane.exe"C:\Users\Admin\HelpPane.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\HelpPane.exe"C:\Users\Admin\HelpPane.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /pid 2088 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 2088 /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI19~1\xmrig.exe C:\Windows\TEMP\xmrig.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI19~1\config.json C:\Windows\TEMP\config.json3⤵
-
-
C:\Windows\TEMP\xmrig.exeC:\Windows\TEMP\xmrig.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram C:\Users\Admin\HelpPane.exe "MyApp" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Port Monitors
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Port Monitors
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD56cb8b560efbc381651d2045f1571d7c8
SHA115283a7a467adb7b6d7a7182f660dd783f90e483
SHA2566456fea123e04bcec8a8eed26160e1df5482e69d187d3e1a0c428995472ac134
SHA512ca2958095e8e08b5ef05ec9de15b7d1eb180923a40b90356db56a124101c96d8e745001948b89dbe9d6b9ce3c2029f7e9eaf20c73fa1d410a821d6605830bfc0
-
Filesize
343KB
MD5ee134421fbabeb565e4f3ca721331c2e
SHA14b03bdd142c6a7bb6f74abe968c5b76b63e06059
SHA2567863e1bedfe1ffc720b67b2eb7b3491db9d2b8e56b5574e6a40ff90336b8dafa
SHA512d27ff65b6a8bf2e5e70d2865e72eee6930e76c2a3990428c54fc998743d3c540c5c984b5d1429e8ffbe3d160ae1f6782cd6d3ca40822f81d2052ba168595d1fa
-
Filesize
21KB
MD5be47363992c7dd90019276d35fa8da76
SHA1ccf7ebbe829da08efd95a53d4ba0c0d4938f6169
SHA256be10254b111713bef20a13d561de61ca3c74a34c64ddc5b10825c64ab2c46734
SHA512573f9111535a9a136fcaaa5c1a16c347f7327626768d849513d69c9848406b1002dcc5b8c17a291ef2e6519587533ca806018ee471a39d330f032a9e7e635ea7
-
Filesize
487KB
MD568c3ad86e0a8833c29ad1be10d3c025d
SHA104488362814b2f3ae07c4e8df8e45868d48b447f
SHA256c236271b92a0f1d3304337f2e2444107f34d8e26272981f48c47db347133566c
SHA512bb2819d913033cc26dcd1e5cbf015dacdbf747d29c72bfd41bfe0d74bb77e51a61cf9be4b67b6348938837125f1d0f80af0ac33531e00cea1585535952a22785
-
Filesize
1KB
MD5b5dea49b86c5bb5d9cd8d64a09f70065
SHA1487ef676ebd244ebc3cf197f70da7a5e393fb96e
SHA25678b1160f6adab34d144ad19a0f4b83f83453f1e18460bbdfbe17ad354b62af7d
SHA5121b5914f4c52f47a33c57f5f6428482e6766099bf43d4e8616ce4aabc4a917c24b2e0c98c841f0d7e7b8a202f40ff960885535539bf70cc7c7ed8687c7ece010c
-
Filesize
877KB
MD58c44826a640b3cf0b32b0258c65fee07
SHA1e3f9fe6366d0876bfa8b903b20d2acf06416f1bc
SHA256fbad053d962bac96865ac3372958d697711800fdc46f36c87011bb5e89026614
SHA512884e2c01c088b9ae86d4605fed1cf8e9b17f99cf887efc5644f4a91959ecd89148cca3e9fdaa6ab9e8c4dfd2d61dbdfd442a95b13dab7e5cd027b4782d473355
-
Filesize
16KB
MD5371397e80a55d432da47311b8ef25317
SHA171617777d6a2500d6464d7b394c8be5f1e4e119e
SHA256c1a900615c9500c46b9602c30c53f299290b03632208ef1152af8830ab73ad17
SHA5123139e2848acf02cc8475449f213873d2c2b7196f6a55c70d2d8f8b487020387740364e5ca0aa584624d1b9b01b965146a2f0e15eef34830c7c0ecbb8637dae03
-
Filesize
11KB
MD5c7807680a69196c3ee66c4cfb3e271ac
SHA1d3ea74c9e3b810c6a1ee4296b97e20f2f45c9461
SHA2561a6c57ac8031582477b1d3463a65b6eb006eea704e27c8c4b812b99ea910428d
SHA512a5d893132ad889e98b434da7fd5ca377afb1800fd8d3230cced5e9fde576fcec943dd22fa48810ba6d93c510ebaa8ac5a94ec1b9d639fd6c533c5bbd4737cf15
-
Filesize
25KB
MD52fc800fcc46a597921c2ed447aeb09ac
SHA172004227e5c60c8460f835a170798aa22861b79e
SHA2562e4ad3d08118da77c928c4614bfecb34397cfaf53f5d46d7c7e5f1da3172c1f1
SHA512a17022b364615b45a1873aea0de922a2988e4d75a8f4e63ecb9ca7dd46263e684b1f28b82bd77b046bbe2ad03ce65c5dacf98eaccae861a30f137e0118a87225
-
Filesize
52KB
MD507b436bfa1c7b4ffc21fb39358158060
SHA17f5a47cdab9a7d93bbbd204cedffca61d3f80c84
SHA25682c2926cb03a04392fa479801d505e2a387446bca978ff930177121db2fdb461
SHA51213ebcb83f478c859ca808003933769b84290e108648b69f33043653263c5b4bd37ed5ca8d521b46a1d9122eb232f7e5d05a25e16f250d5573cf85cd5cdefb2ef
-
Filesize
16KB
MD56a95bcf45e4be23cc2634ef5bad17660
SHA17d13b791588cb800c2add75ff8e74c3c493a8143
SHA25660da4b4e628b7dc1115615128ac554aeb29b50a61629ad5aeeb5cc9d2bd86202
SHA512d3c80b025647444f42d42e82cad50c4383728f7f8c9e16aa9d87450ca864b0b97b5f8f47e80328a4a2b67ce7d06c9a8f1dae8c5b3c798de1b2a50164161e69c8
-
Filesize
34KB
MD542c475231f4835bb1a5f94b0d3da4520
SHA1fcfae296dd10c92d973a57d61bbf5c0f4a15ed6b
SHA25687ceeb1b7586db730f48988a07018f9c8af57934ff7f173a869542207f46b0f1
SHA512d1a699b8497e8843f990f6f719a904a7751fe2a9404cb195be2d94341728a7372cd93d379b576e6031980e1da53f2336805c6bf59e799b63565cd63d4931c02a
-
Filesize
11KB
MD5796306be7a1abcffb8853ee9ceb5beae
SHA193762cf53958a3a99b674986fcf3c53c489133ed
SHA25626e6d883e9e61bf872425526a9b8c7bb229c3b9d2f82bb3c0bf500660dbe1995
SHA5125919a837fa1fcaea91b14d02da306928d5e523e4591dca290422c9eb9be15f2ee626a8379f5c953f2b08e7a6b2cd67618652b9efa9ace8abd47a8bd7cd8c2f64
-
Filesize
18KB
MD5f23a62491bd945c050e3e1d13909e9e7
SHA1b8dac4e00163533157a17e3b56d05e049a2375a2
SHA256e52b5532a6764aaae67db557412b3f77ebdc8a14a72771a1c6414a83bb3fc15c
SHA51252200cf9687752db43bbae703192c841694d5bd976fa56c0f25e0478cfb97681bc77677c1a8907167612ddf9fe6a561945fbeb0180022670af97bf41b5b11766
-
Filesize
6.0MB
MD5a20727b81b50a20483ba59ae65443dfe
SHA17429f81064e044e981de12bde015117953b7b0e7
SHA256af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c
SHA512c6b857207818f1e26065ac424ee5cfdb18e5297ae8c1724a5ec8e80cf96b43bcd31b479859fa863ff508030ce52c60870152b433d548df9fbfc42a378c499856
-
Filesize
1KB
MD550cc63e4a1b24622cf61ed566b03e98f
SHA192e5874785bb76e4579559ba70e116a6149349f5
SHA256348f388c57dfb77b0caacd8304725e10dc69a52eec41ae695327787ad1853c92
SHA5129a291db9cf396687f3878590b1eb65cd7da2e6fc3d6de64a3b8cb08116b646371f432100e16b0ecd4f2916d05d67830f949ac2a3ca559a3a8d56616df2be98c7
-
Filesize
1.8MB
MD513bdd9cd9f7e51746172996262b5a873
SHA13834f8179abd7a827e927505f3c226ac8bbcf3ee
SHA2564bf737b29ff521bc263eb1f2c1c5ea04b47470cccd1beae245d98def389929bd
SHA51249879918505d042312f20b2fc8310a8c4a58aa266ed1ab05e0481f7e11385da0920cf9d756f842eb98e4394f14725385b74a99b38fc8a60222fa4cc873cb8040
-
Filesize
40KB
-
Filesize
116KB
-
Filesize
80KB
-
Filesize
132KB
-
Filesize
68KB
-
Filesize
156KB
-
Filesize
1.4MB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
52KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
2.7MB
-
Filesize
1.0MB
-
Filesize
2.7MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
52KB
-
Filesize
1.4MB
-
Filesize
68KB
-
Filesize
1.0MB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
68KB
-
Filesize
156KB
-
Filesize
56KB
-
Filesize
1.0MB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
1.4MB
-
Filesize
1.0MB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
156KB
-
Filesize
52KB
-
Filesize
56KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
156KB
-
Filesize
2.7MB
-
Filesize
1.4MB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
1.4MB
-
Filesize
1.0MB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
156KB
-
Filesize
132KB
-
Filesize
68KB
-
Filesize
52KB
-
Filesize
56KB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
2.7MB
-
Filesize
56KB
-
Filesize
1.4MB
-
Filesize
80KB
-
Filesize
156KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
1.4MB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
156KB
-
Filesize
56KB
-
Filesize
1.0MB
-
Filesize
80KB
-
Filesize
68KB
-
Filesize
40KB
-
Filesize
52KB
-
Filesize
1.0MB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
5.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
56KB
-
Filesize
52KB
-
Filesize
132KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
156KB
-
Filesize
80KB
-
Filesize
1.0MB
-
Filesize
1.4MB
-
Filesize
68KB
-
Filesize
156KB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
2.7MB
-
Filesize
116KB
-
Filesize
2.7MB