Analysis
-
max time kernel
118s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe
Resource
win7-20240903-en
General
-
Target
8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe
-
Size
5.2MB
-
MD5
28507e76251d6b17e4ad52e570ea7430
-
SHA1
b6ba870480bd4af5dae35e5dfaff7e2ae5724722
-
SHA256
8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503
-
SHA512
eed4196ba21515365321049494a169160ce93551c58b36a136966598613b1e06cd0c6356843639d369be42db36514b9abbe0981ab57873c324c41e9fa1a00bc7
-
SSDEEP
98304:Pe3+ZPTVjEdQELHktz69IGel/Rt+P2kdLYP70pywaa5FooIOzJpDRHqYd+OPxU12:P8+Wbkz69PelZQ5LF6oFlpNxdRq1mcu
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/1852-22-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-27-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-28-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-26-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-25-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-23-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-29-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-30-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1852-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3536 powershell.exe -
Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2024 powercfg.exe 2876 powercfg.exe 1876 powercfg.exe 4504 powercfg.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5104 set thread context of 1852 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 116 -
resource yara_rule behavioral2/memory/1852-22-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-21-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-26-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-25-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-20-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-23-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-18-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-19-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-17-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1852-34-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4440 sc.exe 1668 sc.exe 4792 sc.exe 3172 sc.exe 696 sc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 3536 powershell.exe 3536 powershell.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3536 powershell.exe Token: SeLockMemoryPrivilege 1852 conhost.exe Token: SeShutdownPrivilege 2876 powercfg.exe Token: SeCreatePagefilePrivilege 2876 powercfg.exe Token: SeLockMemoryPrivilege 1852 conhost.exe Token: SeShutdownPrivilege 1876 powercfg.exe Token: SeCreatePagefilePrivilege 1876 powercfg.exe Token: SeShutdownPrivilege 4504 powercfg.exe Token: SeCreatePagefilePrivilege 4504 powercfg.exe Token: SeShutdownPrivilege 2024 powercfg.exe Token: SeCreatePagefilePrivilege 2024 powercfg.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe 1852 conhost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1860 wrote to memory of 3204 1860 cmd.exe 104 PID 1860 wrote to memory of 3204 1860 cmd.exe 104 PID 5104 wrote to memory of 1852 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 116 PID 5104 wrote to memory of 1852 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 116 PID 5104 wrote to memory of 1852 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 116 PID 5104 wrote to memory of 1852 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 116 PID 5104 wrote to memory of 1852 5104 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe"C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3204
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4440
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1668
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4792
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3172
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:696
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82