Analysis
-
max time kernel
89s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe
Resource
win7-20240903-en
General
-
Target
35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe
-
Size
5.5MB
-
MD5
b3b6b62ae29af73db4e5df1056f11070
-
SHA1
124fbab81268b69d9eaf7df696451ae4803bb14c
-
SHA256
35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7e
-
SHA512
0e1dea84ef54020e63211fbff782c66d181b5cff0291c3743f656a8efc20d9c53953ef14c4f36181f5655ab3358d9fdea25e79c77fae602b221c6624daccfafe
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2920-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2920-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2920-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2920-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2920-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2920-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2920-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2920-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2124 powershell.exe 2392 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 1968 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 476 Process not Found 1928 fqwofdtexigy.exe -
Loads dropped DLL 1 IoCs
pid Process 476 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1004 powercfg.exe 1296 powercfg.exe 1012 powercfg.exe 2672 powercfg.exe 2408 powercfg.exe 2664 powercfg.exe 2884 powercfg.exe 1828 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1928 set thread context of 2856 1928 fqwofdtexigy.exe 86 PID 1928 set thread context of 2920 1928 fqwofdtexigy.exe 90 -
resource yara_rule behavioral1/memory/2920-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2920-41-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1912 sc.exe 2900 sc.exe 2816 sc.exe 1708 sc.exe 816 sc.exe 2628 sc.exe 2820 sc.exe 2264 sc.exe 2784 sc.exe 1804 sc.exe 2748 sc.exe 1680 sc.exe 1744 sc.exe 2396 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 50c72a100e27db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2124 powershell.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2584 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1928 fqwofdtexigy.exe 2392 powershell.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 1928 fqwofdtexigy.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe 2920 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2124 powershell.exe Token: SeShutdownPrivilege 2408 powercfg.exe Token: SeShutdownPrivilege 2884 powercfg.exe Token: SeShutdownPrivilege 2672 powercfg.exe Token: SeShutdownPrivilege 2664 powercfg.exe Token: SeDebugPrivilege 2392 powershell.exe Token: SeShutdownPrivilege 1004 powercfg.exe Token: SeShutdownPrivilege 1296 powercfg.exe Token: SeShutdownPrivilege 1012 powercfg.exe Token: SeShutdownPrivilege 1828 powercfg.exe Token: SeLockMemoryPrivilege 2920 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2724 2764 cmd.exe 39 PID 2764 wrote to memory of 2724 2764 cmd.exe 39 PID 2764 wrote to memory of 2724 2764 cmd.exe 39 PID 1968 wrote to memory of 1520 1968 cmd.exe 64 PID 1968 wrote to memory of 1520 1968 cmd.exe 64 PID 1968 wrote to memory of 1520 1968 cmd.exe 64 PID 2520 wrote to memory of 2044 2520 cmd.exe 72 PID 2520 wrote to memory of 2044 2520 cmd.exe 72 PID 2520 wrote to memory of 2044 2520 cmd.exe 72 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2856 1928 fqwofdtexigy.exe 86 PID 1928 wrote to memory of 2920 1928 fqwofdtexigy.exe 90 PID 1928 wrote to memory of 2920 1928 fqwofdtexigy.exe 90 PID 1928 wrote to memory of 2920 1928 fqwofdtexigy.exe 90 PID 1928 wrote to memory of 2920 1928 fqwofdtexigy.exe 90 PID 1928 wrote to memory of 2920 1928 fqwofdtexigy.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe"C:\Users\Admin\AppData\Local\Temp\35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2584 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2724
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2820
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2816
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2748
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2900
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2264
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:2628
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:2784
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1804
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:1680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1520
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2044
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1708
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1744
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2396
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:816
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1912
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2856
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5b3b6b62ae29af73db4e5df1056f11070
SHA1124fbab81268b69d9eaf7df696451ae4803bb14c
SHA25635ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7e
SHA5120e1dea84ef54020e63211fbff782c66d181b5cff0291c3743f656a8efc20d9c53953ef14c4f36181f5655ab3358d9fdea25e79c77fae602b221c6624daccfafe