Analysis
-
max time kernel
106s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe
Resource
win7-20241010-en
General
-
Target
e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe
-
Size
5.6MB
-
MD5
7783428c405057f004c150c584b28fa0
-
SHA1
eb166b4862e0892245acd4ce540c0699c3deb219
-
SHA256
e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686b
-
SHA512
c8a0f407e68ac0dda32f831a6a004caaa923ba94c1372037006172e836c92ef5cfbab5dc6ff8c56ec17bda3213ac8a2d5e4ecdc4fe749c35b84e69eed05a8462
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2516-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2516-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2516-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2516-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2516-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2516-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2516-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2516-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2168 powershell.exe 1176 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 1372 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 468 Process not Found 2852 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
pid Process 468 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1920 powercfg.exe 2888 powercfg.exe 2080 powercfg.exe 968 powercfg.exe 2456 powercfg.exe 820 powercfg.exe 2300 powercfg.exe 2836 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2852 set thread context of 2312 2852 lutlgidagtja.exe 84 PID 2852 set thread context of 2516 2852 lutlgidagtja.exe 88 -
resource yara_rule behavioral1/memory/2516-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2516-41-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1720 sc.exe 2816 sc.exe 2924 sc.exe 2648 sc.exe 2936 sc.exe 1704 sc.exe 984 sc.exe 1300 sc.exe 2828 sc.exe 1836 sc.exe 1072 sc.exe 2896 sc.exe 3004 sc.exe 1388 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 1025b776bf32db01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2168 powershell.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2608 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2852 lutlgidagtja.exe 1176 powershell.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2852 lutlgidagtja.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe 2516 nslookup.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2168 powershell.exe Token: SeShutdownPrivilege 2300 powercfg.exe Token: SeShutdownPrivilege 2888 powercfg.exe Token: SeShutdownPrivilege 1920 powercfg.exe Token: SeShutdownPrivilege 2836 powercfg.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeShutdownPrivilege 2080 powercfg.exe Token: SeShutdownPrivilege 968 powercfg.exe Token: SeShutdownPrivilege 2456 powercfg.exe Token: SeShutdownPrivilege 820 powercfg.exe Token: SeLockMemoryPrivilege 2516 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2868 2812 cmd.exe 36 PID 2812 wrote to memory of 2868 2812 cmd.exe 36 PID 2812 wrote to memory of 2868 2812 cmd.exe 36 PID 1372 wrote to memory of 2092 1372 cmd.exe 62 PID 1372 wrote to memory of 2092 1372 cmd.exe 62 PID 1372 wrote to memory of 2092 1372 cmd.exe 62 PID 1416 wrote to memory of 2496 1416 cmd.exe 70 PID 1416 wrote to memory of 2496 1416 cmd.exe 70 PID 1416 wrote to memory of 2496 1416 cmd.exe 70 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2312 2852 lutlgidagtja.exe 84 PID 2852 wrote to memory of 2516 2852 lutlgidagtja.exe 88 PID 2852 wrote to memory of 2516 2852 lutlgidagtja.exe 88 PID 2852 wrote to memory of 2516 2852 lutlgidagtja.exe 88 PID 2852 wrote to memory of 2516 2852 lutlgidagtja.exe 88 PID 2852 wrote to memory of 2516 2852 lutlgidagtja.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe"C:\Users\Admin\AppData\Local\Temp\e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2608 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2868
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2816
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2936
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2896
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2828
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3004
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:2924
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:1388
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2648
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:1836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2092
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2496
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1720
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1704
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1072
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1300
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:984
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2312
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD57783428c405057f004c150c584b28fa0
SHA1eb166b4862e0892245acd4ce540c0699c3deb219
SHA256e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686b
SHA512c8a0f407e68ac0dda32f831a6a004caaa923ba94c1372037006172e836c92ef5cfbab5dc6ff8c56ec17bda3213ac8a2d5e4ecdc4fe749c35b84e69eed05a8462