Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe
Resource
win7-20240903-en
General
-
Target
8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe
-
Size
5.2MB
-
MD5
28507e76251d6b17e4ad52e570ea7430
-
SHA1
b6ba870480bd4af5dae35e5dfaff7e2ae5724722
-
SHA256
8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503
-
SHA512
eed4196ba21515365321049494a169160ce93551c58b36a136966598613b1e06cd0c6356843639d369be42db36514b9abbe0981ab57873c324c41e9fa1a00bc7
-
SSDEEP
98304:Pe3+ZPTVjEdQELHktz69IGel/Rt+P2kdLYP70pywaa5FooIOzJpDRHqYd+OPxU12:P8+Wbkz69PelZQ5LF6oFlpNxdRq1mcu
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/2360-19-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-20-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-25-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-23-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-22-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-26-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-24-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-28-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-27-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2264 powershell.exe -
Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2560 powercfg.exe 2552 powercfg.exe 2544 powercfg.exe 2816 powercfg.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1940 set thread context of 2360 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 54 -
resource yara_rule behavioral1/memory/2360-14-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-16-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-18-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-19-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-17-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-15-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-20-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-25-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-23-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-22-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-26-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-24-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-27-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2796 sc.exe 2644 sc.exe 2240 sc.exe 2316 sc.exe 2668 sc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 2264 powershell.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2264 powershell.exe Token: SeShutdownPrivilege 2816 powercfg.exe Token: SeShutdownPrivilege 2544 powercfg.exe Token: SeShutdownPrivilege 2552 powercfg.exe Token: SeShutdownPrivilege 2560 powercfg.exe Token: SeLockMemoryPrivilege 2360 conhost.exe Token: SeLockMemoryPrivilege 2360 conhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe 2360 conhost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2548 2776 cmd.exe 38 PID 2776 wrote to memory of 2548 2776 cmd.exe 38 PID 2776 wrote to memory of 2548 2776 cmd.exe 38 PID 1940 wrote to memory of 2360 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 54 PID 1940 wrote to memory of 2360 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 54 PID 1940 wrote to memory of 2360 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 54 PID 1940 wrote to memory of 2360 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 54 PID 1940 wrote to memory of 2360 1940 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe"C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2548
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2796
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2668
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2240
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2644
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2316
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2360
-