Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
05/08/2024, 12:44
General
-
Target
666c246bd662275c5a7330b4de2e51a7f86556390c0b79b1d774378e7eac8cb0.exe
-
Size
3.3MB
-
MD5
e211b2b230ef040fe40bc380899990fc
-
SHA1
fe36dbf3efa775193b82ce03d1b329d3feced487
-
SHA256
666c246bd662275c5a7330b4de2e51a7f86556390c0b79b1d774378e7eac8cb0
-
SHA512
d8e52248278898617e42afe93171f4400612b37b596c8fef5d7f7d98a217a1f8ff86414a4f9e567d316980309a4e8d98050877dcef139f24cb77c85764d979a3
-
SSDEEP
49152:IpMb87gil2wlWJDddoneZxq03EjlI+pOZjlx+o1Mj+6001YP:9bZRE4+Kr60n
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
XMRig Miner payload 10 IoCs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\666c246bd662275c5a7330b4de2e51a7f86556390c0b79b1d774378e7eac8cb0.exe"C:\Users\Admin\AppData\Local\Temp\666c246bd662275c5a7330b4de2e51a7f86556390c0b79b1d774378e7eac8cb0.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Windows\windowsaudioservice.exe"C:\Users\Admin\AppData\Local\Windows\windowsaudioservice.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD5bc35928aafc2827ce620e2aa679aadd5
SHA1a6f772792e66154facb2f0df9ea068459d848f8e
SHA2569fa246f0de2072d3bc060e6e532e76395fa73b5a2d2c4aa5ffdf66d190bab446
SHA512d2d3f0c9b3fa7fd1d6496b141a801942ea6e09154b9d4d7318cfddf10a3e7d129701fa775a92c09b3ed241b11e06078b074de1fe107315664e743db28aa3b558
-
Filesize
8KB
-
Filesize
14.7MB
-
Filesize
14.7MB
-
Filesize
14.7MB
-
Filesize
14.7MB
-
Filesize
128KB
-
Filesize
2.0MB
-
Filesize
14.7MB
-
Filesize
14.7MB
-
Filesize
14.7MB
-
Filesize
14.7MB
-
Filesize
14.7MB
-
Filesize
14.7MB
-
Filesize
14.7MB