Analysis

  • max time kernel
    82s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/10/2024, 18:52

General

  • Target

    f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe

  • Size

    5.5MB

  • MD5

    88d4f016499352c4c85a23f2a4bfd990

  • SHA1

    b8644cefd7655ff33792628373921a219b913cbd

  • SHA256

    f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094

  • SHA512

    92ffaa7cd9a0c7ce831d0b99b43a4b0507a5dfbd65aa0357c6129fc1cfeaf0493bdfb626d2637b1a747e22e300cbbd8d0e268ea22b41726d601e26714720a3fc

  • SSDEEP

    98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe
    "C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:320
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2280
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Drops file in Windows directory
        PID:2840
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      2⤵
      • Launches sc.exe
      PID:2704
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      2⤵
      • Launches sc.exe
      PID:2800
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      2⤵
      • Launches sc.exe
      PID:2688
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      2⤵
      • Launches sc.exe
      PID:2716
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      2⤵
      • Launches sc.exe
      PID:2892
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2292
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2720
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2792
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "JVNIRHNX"
      2⤵
      • Launches sc.exe
      PID:1988
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"
      2⤵
      • Launches sc.exe
      PID:1864
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      2⤵
      • Launches sc.exe
      PID:744
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "JVNIRHNX"
      2⤵
      • Launches sc.exe
      PID:1608
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\system32\choice.exe
        choice /C Y /N /D Y /T 3
        3⤵
          PID:2528
    • C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe
      C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:884
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1320
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
          • Drops file in Windows directory
          PID:2008
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop UsoSvc
        2⤵
        • Launches sc.exe
        PID:2356
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        2⤵
        • Launches sc.exe
        PID:1604
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop wuauserv
        2⤵
        • Launches sc.exe
        PID:1252
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop bits
        2⤵
        • Launches sc.exe
        PID:1920
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop dosvc
        2⤵
        • Launches sc.exe
        PID:1780
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:1280
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:1408
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2760
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2428
      • C:\Windows\system32\conhost.exe
        C:\Windows\system32\conhost.exe
        2⤵
          PID:2408
        • C:\Windows\system32\nslookup.exe
          nslookup.exe
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2268

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • \ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe

              Filesize

              5.5MB

              MD5

              88d4f016499352c4c85a23f2a4bfd990

              SHA1

              b8644cefd7655ff33792628373921a219b913cbd

              SHA256

              f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094

              SHA512

              92ffaa7cd9a0c7ce831d0b99b43a4b0507a5dfbd65aa0357c6129fc1cfeaf0493bdfb626d2637b1a747e22e300cbbd8d0e268ea22b41726d601e26714720a3fc

            • memory/1320-18-0x0000000000A20000-0x0000000000A28000-memory.dmp

              Filesize

              32KB

            • memory/1320-17-0x0000000019F40000-0x000000001A222000-memory.dmp

              Filesize

              2.9MB

            • memory/2268-33-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-41-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-30-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-37-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-31-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-36-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-32-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-29-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-42-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-34-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-35-0x00000000000B0000-0x00000000000D0000-memory.dmp

              Filesize

              128KB

            • memory/2268-38-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-39-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-40-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2268-28-0x0000000140000000-0x0000000140848000-memory.dmp

              Filesize

              8.3MB

            • memory/2280-12-0x000007FEF5780000-0x000007FEF611D000-memory.dmp

              Filesize

              9.6MB

            • memory/2280-8-0x000007FEF5780000-0x000007FEF611D000-memory.dmp

              Filesize

              9.6MB

            • memory/2280-5-0x000000001B560000-0x000000001B842000-memory.dmp

              Filesize

              2.9MB

            • memory/2280-6-0x0000000001E20000-0x0000000001E28000-memory.dmp

              Filesize

              32KB

            • memory/2280-7-0x000007FEF5780000-0x000007FEF611D000-memory.dmp

              Filesize

              9.6MB

            • memory/2280-9-0x000007FEF5780000-0x000007FEF611D000-memory.dmp

              Filesize

              9.6MB

            • memory/2280-4-0x000007FEF5A3E000-0x000007FEF5A3F000-memory.dmp

              Filesize

              4KB

            • memory/2280-10-0x000007FEF5780000-0x000007FEF611D000-memory.dmp

              Filesize

              9.6MB

            • memory/2280-11-0x000007FEF5780000-0x000007FEF611D000-memory.dmp

              Filesize

              9.6MB

            • memory/2408-23-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/2408-20-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/2408-19-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/2408-22-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/2408-21-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/2408-26-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB