Analysis
-
max time kernel
120s -
max time network
109s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe
Resource
win7-20240729-en
General
-
Target
ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe
-
Size
5.5MB
-
MD5
0281e94727f66b87296dc379569706e0
-
SHA1
80635505f84125327716001ea8715e6dda2291cd
-
SHA256
ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0
-
SHA512
aa29754269cb6797503059e10edcfa428953922d61e0cb2a0573db86511b10a62a3f529bc3a4d7221daabf353c2454655eb023b254da857be9a462b55f354a9b
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2360-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-31-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2360-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2648 powershell.exe 1444 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 1412 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 472 Process not Found 2332 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
pid Process 472 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2804 powercfg.exe 1772 powercfg.exe 2252 powercfg.exe 2468 powercfg.exe 2396 powercfg.exe 1904 powercfg.exe 2216 powercfg.exe 1616 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2332 set thread context of 2212 2332 lutlgidagtja.exe 87 PID 2332 set thread context of 2360 2332 lutlgidagtja.exe 90 -
resource yara_rule behavioral1/memory/2360-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-26-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2360-40-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2860 sc.exe 2504 sc.exe 2568 sc.exe 2816 sc.exe 2336 sc.exe 1836 sc.exe 2548 sc.exe 2580 sc.exe 2544 sc.exe 2996 sc.exe 1432 sc.exe 1952 sc.exe 1500 sc.exe 348 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 0052cfec1527db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2648 powershell.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2756 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2332 lutlgidagtja.exe 1444 powershell.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2332 lutlgidagtja.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe 2360 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2648 powershell.exe Token: SeShutdownPrivilege 2252 powercfg.exe Token: SeShutdownPrivilege 2804 powercfg.exe Token: SeShutdownPrivilege 1616 powercfg.exe Token: SeShutdownPrivilege 1772 powercfg.exe Token: SeDebugPrivilege 1444 powershell.exe Token: SeShutdownPrivilege 2468 powercfg.exe Token: SeShutdownPrivilege 1904 powercfg.exe Token: SeShutdownPrivilege 2396 powercfg.exe Token: SeShutdownPrivilege 2216 powercfg.exe Token: SeLockMemoryPrivilege 2360 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2820 2844 cmd.exe 38 PID 2844 wrote to memory of 2820 2844 cmd.exe 38 PID 2844 wrote to memory of 2820 2844 cmd.exe 38 PID 1412 wrote to memory of 1920 1412 cmd.exe 64 PID 1412 wrote to memory of 1920 1412 cmd.exe 64 PID 1412 wrote to memory of 1920 1412 cmd.exe 64 PID 2512 wrote to memory of 752 2512 cmd.exe 72 PID 2512 wrote to memory of 752 2512 cmd.exe 72 PID 2512 wrote to memory of 752 2512 cmd.exe 72 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2212 2332 lutlgidagtja.exe 87 PID 2332 wrote to memory of 2360 2332 lutlgidagtja.exe 90 PID 2332 wrote to memory of 2360 2332 lutlgidagtja.exe 90 PID 2332 wrote to memory of 2360 2332 lutlgidagtja.exe 90 PID 2332 wrote to memory of 2360 2332 lutlgidagtja.exe 90 PID 2332 wrote to memory of 2360 2332 lutlgidagtja.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe"C:\Users\Admin\AppData\Local\Temp\ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2756 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2820
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2548
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2580
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2544
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2568
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2996
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:2860
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:1432
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1836
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:1952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1920
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:752
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2816
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1500
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:348
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2504
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2336
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2212
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD50281e94727f66b87296dc379569706e0
SHA180635505f84125327716001ea8715e6dda2291cd
SHA256ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0
SHA512aa29754269cb6797503059e10edcfa428953922d61e0cb2a0573db86511b10a62a3f529bc3a4d7221daabf353c2454655eb023b254da857be9a462b55f354a9b