Analysis
-
max time kernel
82s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe
Resource
win7-20240903-en
General
-
Target
f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe
-
Size
5.5MB
-
MD5
88d4f016499352c4c85a23f2a4bfd990
-
SHA1
b8644cefd7655ff33792628373921a219b913cbd
-
SHA256
f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094
-
SHA512
92ffaa7cd9a0c7ce831d0b99b43a4b0507a5dfbd65aa0357c6129fc1cfeaf0493bdfb626d2637b1a747e22e300cbbd8d0e268ea22b41726d601e26714720a3fc
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/2268-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2268-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2268-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2268-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2268-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2268-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2268-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2268-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2268-42-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2280 powershell.exe 1320 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 2024 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 476 Process not Found 884 fqwofdtexigy.exe -
Loads dropped DLL 1 IoCs
pid Process 476 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2292 powercfg.exe 2428 powercfg.exe 2760 powercfg.exe 1408 powercfg.exe 1280 powercfg.exe 2792 powercfg.exe 2668 powercfg.exe 2720 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 884 set thread context of 2408 884 fqwofdtexigy.exe 86 PID 884 set thread context of 2268 884 fqwofdtexigy.exe 90 -
resource yara_rule behavioral1/memory/2268-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-41-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2268-42-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 744 sc.exe 1604 sc.exe 1780 sc.exe 2688 sc.exe 2892 sc.exe 1252 sc.exe 1920 sc.exe 2356 sc.exe 1988 sc.exe 1864 sc.exe 2800 sc.exe 2716 sc.exe 2704 sc.exe 1608 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 406e26130f27db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2280 powershell.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 320 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 884 fqwofdtexigy.exe 1320 powershell.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 884 fqwofdtexigy.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe 2268 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2280 powershell.exe Token: SeShutdownPrivilege 2720 powercfg.exe Token: SeShutdownPrivilege 2792 powercfg.exe Token: SeShutdownPrivilege 2292 powercfg.exe Token: SeShutdownPrivilege 2668 powercfg.exe Token: SeDebugPrivilege 1320 powershell.exe Token: SeShutdownPrivilege 1408 powercfg.exe Token: SeShutdownPrivilege 2760 powercfg.exe Token: SeShutdownPrivilege 1280 powercfg.exe Token: SeShutdownPrivilege 2428 powercfg.exe Token: SeLockMemoryPrivilege 2268 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2840 2684 cmd.exe 37 PID 2684 wrote to memory of 2840 2684 cmd.exe 37 PID 2684 wrote to memory of 2840 2684 cmd.exe 37 PID 2024 wrote to memory of 2528 2024 cmd.exe 64 PID 2024 wrote to memory of 2528 2024 cmd.exe 64 PID 2024 wrote to memory of 2528 2024 cmd.exe 64 PID 1828 wrote to memory of 2008 1828 cmd.exe 73 PID 1828 wrote to memory of 2008 1828 cmd.exe 73 PID 1828 wrote to memory of 2008 1828 cmd.exe 73 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2408 884 fqwofdtexigy.exe 86 PID 884 wrote to memory of 2268 884 fqwofdtexigy.exe 90 PID 884 wrote to memory of 2268 884 fqwofdtexigy.exe 90 PID 884 wrote to memory of 2268 884 fqwofdtexigy.exe 90 PID 884 wrote to memory of 2268 884 fqwofdtexigy.exe 90 PID 884 wrote to memory of 2268 884 fqwofdtexigy.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe"C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:320 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2840
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2704
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2800
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2688
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2716
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2892
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:1988
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:1864
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:744
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:1608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2528
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2008
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2356
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1604
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1252
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1920
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1780
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2408
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD588d4f016499352c4c85a23f2a4bfd990
SHA1b8644cefd7655ff33792628373921a219b913cbd
SHA256f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094
SHA51292ffaa7cd9a0c7ce831d0b99b43a4b0507a5dfbd65aa0357c6129fc1cfeaf0493bdfb626d2637b1a747e22e300cbbd8d0e268ea22b41726d601e26714720a3fc