Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2024, 15:02

General

  • Target

    a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe

  • Size

    5.8MB

  • MD5

    190e68a764f232fa236a23317f80892b

  • SHA1

    a37b9e226334bc69abaacb539fb7ba9722831a76

  • SHA256

    a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7

  • SHA512

    34c5d7d35a639a2c6ea183ad808a10bc0adaebf806975f6949da119c1d90c50f065b3d238a0bd6b7159394fe39a0322590fe229cae73f7c9cc393e721449c0a2

  • SSDEEP

    98304:ICAKtK2disEKWIAN9rDUQ60m+E+3syUSIkJEhxfAF8p4ucmEyVHNJdNOD5A:I7ObErIYeQ3nEIsyU2Y48CeHxNV

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe
    "C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2364
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2932
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1156
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Drops file in Windows directory
        PID:2960
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      2⤵
      • Launches sc.exe
      PID:824
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      2⤵
      • Launches sc.exe
      PID:2796
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      2⤵
      • Launches sc.exe
      PID:2404
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      2⤵
      • Launches sc.exe
      PID:2844
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      2⤵
      • Launches sc.exe
      PID:2688
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2664
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:3056
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2792
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
      2⤵
      • Launches sc.exe
      PID:2744
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
      2⤵
      • Launches sc.exe
      PID:2692
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      2⤵
      • Launches sc.exe
      PID:3036
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
      2⤵
      • Launches sc.exe
      PID:2456
  • C:\ProgramData\GoogleUP\Chrome\Updater.exe
    C:\ProgramData\GoogleUP\Chrome\Updater.exe
    1⤵
    • Drops file in Drivers directory
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1732
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:888
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Drops file in Windows directory
        PID:1944
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      2⤵
      • Launches sc.exe
      PID:2808
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      2⤵
      • Launches sc.exe
      PID:2080
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      2⤵
      • Launches sc.exe
      PID:2316
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      2⤵
      • Launches sc.exe
      PID:2012
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      2⤵
      • Launches sc.exe
      PID:1432
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2232
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:3020
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:2924
    • C:\Windows\system32\conhost.exe
      C:\Windows\system32\conhost.exe
      2⤵
        PID:2260
      • C:\Windows\explorer.exe
        explorer.exe
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1972

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\GoogleUP\Chrome\Updater.exe

            Filesize

            5.8MB

            MD5

            190e68a764f232fa236a23317f80892b

            SHA1

            a37b9e226334bc69abaacb539fb7ba9722831a76

            SHA256

            a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7

            SHA512

            34c5d7d35a639a2c6ea183ad808a10bc0adaebf806975f6949da119c1d90c50f065b3d238a0bd6b7159394fe39a0322590fe229cae73f7c9cc393e721449c0a2

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            2KB

            MD5

            3e9af076957c5b2f9c9ce5ec994bea05

            SHA1

            a8c7326f6bceffaeed1c2bb8d7165e56497965fe

            SHA256

            e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e

            SHA512

            933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

          • memory/1732-21-0x0000000019E30000-0x000000001A112000-memory.dmp

            Filesize

            2.9MB

          • memory/1732-22-0x00000000009A0000-0x00000000009A8000-memory.dmp

            Filesize

            32KB

          • memory/1972-38-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-42-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-47-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-48-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-46-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-45-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-44-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-43-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-41-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1972-39-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-40-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-36-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-37-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-35-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/1972-34-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/2260-32-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/2260-25-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/2260-26-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/2260-27-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/2260-28-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/2260-29-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/2364-0-0x000000013FDD0000-0x00000001409D6000-memory.dmp

            Filesize

            12.0MB

          • memory/2904-19-0x000000013F660000-0x0000000140266000-memory.dmp

            Filesize

            12.0MB

          • memory/2932-10-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

            Filesize

            9.6MB

          • memory/2932-14-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

            Filesize

            9.6MB

          • memory/2932-13-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

            Filesize

            9.6MB

          • memory/2932-9-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

            Filesize

            9.6MB

          • memory/2932-8-0x00000000026A0000-0x00000000026A8000-memory.dmp

            Filesize

            32KB

          • memory/2932-7-0x000000001B600000-0x000000001B8E2000-memory.dmp

            Filesize

            2.9MB

          • memory/2932-6-0x000007FEF5C8E000-0x000007FEF5C8F000-memory.dmp

            Filesize

            4KB

          • memory/2932-12-0x000000000289B000-0x0000000002902000-memory.dmp

            Filesize

            412KB

          • memory/2932-11-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

            Filesize

            9.6MB