Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/10/2024, 05:03

General

  • Target

    file.exe

  • Size

    8.3MB

  • MD5

    66039c9e643542b612ee5b216900c910

  • SHA1

    3af08524281635f64e17f89838c6e528da7d723c

  • SHA256

    35c6740a3fb5e35fc261d619abd34c2aaaa761096e36bb03515b536998bc1144

  • SHA512

    220901ea547e2200700059944209958b929f237d58f6275fcca3ec27352766e002674202611f1f850074eb4b8bbe0b97797fd170265d9446f54a50bfbe0f79a0

  • SSDEEP

    196608:ZBH5dgA2rBsUPeOOsmgGZ6SO7gTTYFaklmZChu+5pz:zEAIeOOsmguLtTd8hb5pz

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • XMRig Miner payload 18 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2872
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4808
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3544
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
          PID:4116
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop UsoSvc
        2⤵
        • Launches sc.exe
        PID:1232
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        2⤵
        • Launches sc.exe
        PID:844
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop wuauserv
        2⤵
        • Launches sc.exe
        PID:1016
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop bits
        2⤵
        • Launches sc.exe
        PID:4340
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop dosvc
        2⤵
        • Launches sc.exe
        PID:4752
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:928
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:4932
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:3952
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        2⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        2⤵
        • Launches sc.exe
        PID:4284
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        2⤵
        • Launches sc.exe
        PID:3632
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop eventlog
        2⤵
        • Launches sc.exe
        PID:1748
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        2⤵
        • Launches sc.exe
        PID:3004
    • C:\ProgramData\Google\Chrome\updater.exe
      C:\ProgramData\Google\Chrome\updater.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Drops file in Drivers directory
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:208
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3152
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
            PID:3052
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          2⤵
          • Launches sc.exe
          PID:2532
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          2⤵
          • Launches sc.exe
          PID:2960
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          2⤵
          • Launches sc.exe
          PID:332
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          2⤵
          • Launches sc.exe
          PID:2428
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          2⤵
          • Launches sc.exe
          PID:1688
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:4416
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1968
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:4324
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1196
        • C:\Windows\system32\conhost.exe
          C:\Windows\system32\conhost.exe
          2⤵
            PID:1380
          • C:\Windows\explorer.exe
            explorer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1716

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\Google\Chrome\updater.exe

                Filesize

                8.3MB

                MD5

                66039c9e643542b612ee5b216900c910

                SHA1

                3af08524281635f64e17f89838c6e528da7d723c

                SHA256

                35c6740a3fb5e35fc261d619abd34c2aaaa761096e36bb03515b536998bc1144

                SHA512

                220901ea547e2200700059944209958b929f237d58f6275fcca3ec27352766e002674202611f1f850074eb4b8bbe0b97797fd170265d9446f54a50bfbe0f79a0

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_azn4o13s.ndc.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Windows\system32\drivers\etc\hosts

                Filesize

                3KB

                MD5

                00930b40cba79465b7a38ed0449d1449

                SHA1

                4b25a89ee28b20ba162f23772ddaf017669092a5

                SHA256

                eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                SHA512

                cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

              • memory/208-55-0x000002C946B50000-0x000002C946B6A000-memory.dmp

                Filesize

                104KB

              • memory/208-50-0x000002C9468C0000-0x000002C9468DC000-memory.dmp

                Filesize

                112KB

              • memory/208-51-0x000002C9468E0000-0x000002C946995000-memory.dmp

                Filesize

                724KB

              • memory/208-52-0x000002C9469A0000-0x000002C9469AA000-memory.dmp

                Filesize

                40KB

              • memory/208-53-0x000002C946B10000-0x000002C946B2C000-memory.dmp

                Filesize

                112KB

              • memory/208-58-0x000002C946B40000-0x000002C946B4A000-memory.dmp

                Filesize

                40KB

              • memory/208-54-0x000002C946AF0000-0x000002C946AFA000-memory.dmp

                Filesize

                40KB

              • memory/208-57-0x000002C946B30000-0x000002C946B36000-memory.dmp

                Filesize

                24KB

              • memory/208-56-0x000002C946B00000-0x000002C946B08000-memory.dmp

                Filesize

                32KB

              • memory/1380-63-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

              • memory/1380-64-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

              • memory/1380-65-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

              • memory/1380-67-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

              • memory/1380-70-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

              • memory/1380-66-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

              • memory/1716-82-0x00000000018B0000-0x00000000018D0000-memory.dmp

                Filesize

                128KB

              • memory/1716-76-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-94-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-93-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-92-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-90-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-89-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-71-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-73-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-85-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-75-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-72-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-74-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-78-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-79-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-77-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-88-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-86-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-81-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/1716-87-0x0000000140000000-0x000000014082C000-memory.dmp

                Filesize

                8.2MB

              • memory/2872-4-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp

                Filesize

                15.5MB

              • memory/2872-25-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp

                Filesize

                15.5MB

              • memory/2872-1-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp

                Filesize

                15.5MB

              • memory/2872-2-0x00007FF9A9FD0000-0x00007FF9A9FD2000-memory.dmp

                Filesize

                8KB

              • memory/2872-0-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp

                Filesize

                15.5MB

              • memory/2872-3-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp

                Filesize

                15.5MB

              • memory/2872-5-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp

                Filesize

                15.5MB

              • memory/4808-16-0x0000027B1BBC0000-0x0000027B1BBE2000-memory.dmp

                Filesize

                136KB

              • memory/4808-8-0x00007FF9A9F30000-0x00007FF9AA125000-memory.dmp

                Filesize

                2.0MB

              • memory/4808-9-0x00007FF9A9F30000-0x00007FF9AA125000-memory.dmp

                Filesize

                2.0MB

              • memory/4808-22-0x00007FF9A9F30000-0x00007FF9AA125000-memory.dmp

                Filesize

                2.0MB

              • memory/4808-7-0x00007FF9A9F30000-0x00007FF9AA125000-memory.dmp

                Filesize

                2.0MB

              • memory/4956-31-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp

                Filesize

                15.5MB

              • memory/4956-84-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp

                Filesize

                15.5MB

              • memory/4956-28-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp

                Filesize

                15.5MB

              • memory/4956-29-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp

                Filesize

                15.5MB

              • memory/4956-30-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp

                Filesize

                15.5MB