Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
27/10/2024, 00:09
Behavioral task
behavioral1
Sample
0x0006000000016d4e-54.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
- Target 0x0006000000016d4e-54.exe
- Size 10KB
- Sample241027-aft7ms1bph
- SHA256 a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
- MD5 96509ab828867d81c1693b614b22f41d
- SHA1 c5f82005dbda43cedd86708cc5fc3635a781a67e
- SHA512 ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca
- SSDEEP 96:vdHiIV5H6c10lqo9ZYAoQdVDCcJ+587tG6AuJxGE9btz2qhRC7tCEOhd1Q:vdHiQ5HV1wr9KA/J+izJxTZtzthyOhd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 4504 created 3444 4504 2447833663.exe 56 PID 4504 created 3444 4504 2447833663.exe 56 PID 5060 created 3444 5060 winupsecvmgr.exe 56 PID 5060 created 3444 5060 winupsecvmgr.exe 56 PID 5060 created 3444 5060 winupsecvmgr.exe 56 - Xmrig family
- XMRig Miner payload 13 IoCs
resource yara_rule behavioral2/memory/5060-42-0x00007FF7E02D0000-0x00007FF7E0867000-memory.dmp xmrig behavioral2/memory/3900-45-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-47-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-49-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-51-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-53-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-55-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-57-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-59-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-61-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-63-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-65-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig behavioral2/memory/3900-67-0x00007FF7F1A60000-0x00007FF7F224F000-memory.dmp xmrig - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4504 2447833663.exe 5060 winupsecvmgr.exe -
pid Process 1840 powershell.exe 2284 powershell.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5060 set thread context of 708 5060 winupsecvmgr.exe 110 PID 5060 set thread context of 3900 5060 winupsecvmgr.exe 111 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0x0006000000016d4e-54.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4504 2447833663.exe 4504 2447833663.exe 1840 powershell.exe 1840 powershell.exe 4504 2447833663.exe 4504 2447833663.exe 5060 winupsecvmgr.exe 5060 winupsecvmgr.exe 2284 powershell.exe 2284 powershell.exe 5060 winupsecvmgr.exe 5060 winupsecvmgr.exe 5060 winupsecvmgr.exe 5060 winupsecvmgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1840 powershell.exe Token: SeIncreaseQuotaPrivilege 1840 powershell.exe Token: SeSecurityPrivilege 1840 powershell.exe Token: SeTakeOwnershipPrivilege 1840 powershell.exe Token: SeLoadDriverPrivilege 1840 powershell.exe Token: SeSystemProfilePrivilege 1840 powershell.exe Token: SeSystemtimePrivilege 1840 powershell.exe Token: SeProfSingleProcessPrivilege 1840 powershell.exe Token: SeIncBasePriorityPrivilege 1840 powershell.exe Token: SeCreatePagefilePrivilege 1840 powershell.exe Token: SeBackupPrivilege 1840 powershell.exe Token: SeRestorePrivilege 1840 powershell.exe Token: SeShutdownPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeSystemEnvironmentPrivilege 1840 powershell.exe Token: SeRemoteShutdownPrivilege 1840 powershell.exe Token: SeUndockPrivilege 1840 powershell.exe Token: SeManageVolumePrivilege 1840 powershell.exe Token: 33 1840 powershell.exe Token: 34 1840 powershell.exe Token: 35 1840 powershell.exe Token: 36 1840 powershell.exe Token: SeIncreaseQuotaPrivilege 1840 powershell.exe Token: SeSecurityPrivilege 1840 powershell.exe Token: SeTakeOwnershipPrivilege 1840 powershell.exe Token: SeLoadDriverPrivilege 1840 powershell.exe Token: SeSystemProfilePrivilege 1840 powershell.exe Token: SeSystemtimePrivilege 1840 powershell.exe Token: SeProfSingleProcessPrivilege 1840 powershell.exe Token: SeIncBasePriorityPrivilege 1840 powershell.exe Token: SeCreatePagefilePrivilege 1840 powershell.exe Token: SeBackupPrivilege 1840 powershell.exe Token: SeRestorePrivilege 1840 powershell.exe Token: SeShutdownPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeSystemEnvironmentPrivilege 1840 powershell.exe Token: SeRemoteShutdownPrivilege 1840 powershell.exe Token: SeUndockPrivilege 1840 powershell.exe Token: SeManageVolumePrivilege 1840 powershell.exe Token: 33 1840 powershell.exe Token: 34 1840 powershell.exe Token: 35 1840 powershell.exe Token: 36 1840 powershell.exe Token: SeIncreaseQuotaPrivilege 1840 powershell.exe Token: SeSecurityPrivilege 1840 powershell.exe Token: SeTakeOwnershipPrivilege 1840 powershell.exe Token: SeLoadDriverPrivilege 1840 powershell.exe Token: SeSystemProfilePrivilege 1840 powershell.exe Token: SeSystemtimePrivilege 1840 powershell.exe Token: SeProfSingleProcessPrivilege 1840 powershell.exe Token: SeIncBasePriorityPrivilege 1840 powershell.exe Token: SeCreatePagefilePrivilege 1840 powershell.exe Token: SeBackupPrivilege 1840 powershell.exe Token: SeRestorePrivilege 1840 powershell.exe Token: SeShutdownPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeSystemEnvironmentPrivilege 1840 powershell.exe Token: SeRemoteShutdownPrivilege 1840 powershell.exe Token: SeUndockPrivilege 1840 powershell.exe Token: SeManageVolumePrivilege 1840 powershell.exe Token: 33 1840 powershell.exe Token: 34 1840 powershell.exe Token: 35 1840 powershell.exe Token: 36 1840 powershell.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe 3900 dwm.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3544 wrote to memory of 4504 3544 0x0006000000016d4e-54.exe 97 PID 3544 wrote to memory of 4504 3544 0x0006000000016d4e-54.exe 97 PID 5060 wrote to memory of 708 5060 winupsecvmgr.exe 110 PID 5060 wrote to memory of 3900 5060 winupsecvmgr.exe 111 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\0x0006000000016d4e-54.exe"C:\Users\Admin\AppData\Local\Temp\0x0006000000016d4e-54.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\2447833663.exeC:\Users\Admin\AppData\Local\Temp\2447833663.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4504
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵PID:836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:708
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3900
-
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
- MD5 fee026663fcb662152188784794028ee
- SHA1 3c02a26a9cb16648fad85c6477b68ced3cb0cb45
- SHA512 7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 3c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e
- MD5 2ac3c9ba89b8c2ef19c601ecebb82157
- SHA1 a239a4b11438c00e5ff89ebd4a804ede6a01935b
- SHA512 b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2447833663.exe
- Size 5.6MB
- SHA256 1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
- MD5 13b26b2c7048a92d6a843c1302618fad
- SHA1 89c2dfc01ac12ef2704c7669844ec69f1700c1ca
- SHA512 d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
- SSDEEP 98304:ZMknXV8IFUX81qQ6lLYhJ/N0TB4HBDxWcLKamiwPZhsSZLZ1wpxGN:ZBnXV86UiqrlLY/8AW6YZPZf6HGN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zaxi1tux.rxs.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512