Analysis Overview
SHA256
8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503
Threat Level: Known bad
The file 8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N was found to be: Known bad.
Malicious Activity Summary
Xmrig family
xmrig
XMRig Miner payload
Stops running service(s)
Command and Scripting Interpreter: PowerShell
Power Settings
Suspicious use of SetThreadContext
UPX packed file
Drops file in System32 directory
Launches sc.exe
Drops file in Windows directory
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-25 21:37
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-25 21:37
Reported
2024-10-25 21:39
Platform
win7-20240903-en
Max time kernel
119s
Max time network
120s
Command Line
Signatures
Xmrig family
xmrig
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Stops running service(s)
Power Settings
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\system32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\system32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\system32\powercfg.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\system32\MRT.exe | C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1940 set thread context of 2360 | N/A | C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe | C:\Windows\system32\conhost.exe |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\wusa.lock | C:\Windows\system32\wusa.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\conhost.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\conhost.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe
"C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe"
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
C:\Windows\system32\conhost.exe
conhost.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | us-zephyr.miningocean.org | udp |
| US | 15.204.240.197:5432 | us-zephyr.miningocean.org | tcp |
Files
memory/2264-4-0x000007FEF58EE000-0x000007FEF58EF000-memory.dmp
memory/2264-5-0x000000001B570000-0x000000001B852000-memory.dmp
memory/2264-9-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp
memory/2264-8-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp
memory/2264-7-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp
memory/2264-6-0x0000000001CD0000-0x0000000001CD8000-memory.dmp
memory/2264-10-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp
memory/2264-11-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp
memory/2264-12-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp
memory/2360-14-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-16-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-18-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-21-0x00000000000B0000-0x00000000000D0000-memory.dmp
memory/2360-19-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-17-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-15-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-20-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-25-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-23-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-22-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-26-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-24-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-28-0x0000000140000000-0x0000000140848000-memory.dmp
memory/2360-27-0x0000000140000000-0x0000000140848000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-25 21:37
Reported
2024-10-25 21:39
Platform
win10v2004-20241007-en
Max time kernel
118s
Max time network
96s
Command Line
Signatures
Xmrig family
xmrig
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Stops running service(s)
Power Settings
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\system32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\system32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\system32\powercfg.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\MRT.exe | C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 5104 set thread context of 1852 | N/A | C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe | C:\Windows\system32\conhost.exe |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\conhost.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\conhost.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\powercfg.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe
"C:\Users\Admin\AppData\Local\Temp\8c85440c62921c5f13105c06800d48d7c65094ae3dd54ecb8377fcc6f03cb503N.exe"
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
C:\Windows\system32\conhost.exe
conhost.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.108.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | us-zephyr.miningocean.org | udp |
| US | 15.204.240.197:5432 | us-zephyr.miningocean.org | tcp |
| US | 8.8.8.8:53 | 197.240.204.15.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.11.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.108.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
Files
memory/3536-0-0x00007FFE415D3000-0x00007FFE415D5000-memory.dmp
memory/3536-1-0x00000195BB250000-0x00000195BB272000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u43o4zqw.ub2.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3536-11-0x00007FFE415D0000-0x00007FFE42091000-memory.dmp
memory/3536-12-0x00007FFE415D0000-0x00007FFE42091000-memory.dmp
memory/3536-15-0x00007FFE415D0000-0x00007FFE42091000-memory.dmp
memory/1852-24-0x000001BD2C110000-0x000001BD2C130000-memory.dmp
memory/1852-22-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-21-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-27-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-28-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-26-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-25-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-20-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-23-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-18-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-19-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-17-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-29-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-30-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-32-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-33-0x0000000140000000-0x0000000140848000-memory.dmp
memory/1852-34-0x0000000140000000-0x0000000140848000-memory.dmp