Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe
Resource
win7-20241023-en
General
-
Target
ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe
-
Size
5.6MB
-
MD5
70658e51f1df013fd7eeae4ee5b03ec0
-
SHA1
2c0ce8645a3662ff5f5bc1949b5847c54c5adea0
-
SHA256
ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786
-
SHA512
ec758b1992827c557c20bb532e8824a629ff9a40a8bd7c8f1b7d42f68806fbe68ded062f8a8462da0c768129fef546dd8df73c004e1c2fbd1b2a38ad55b1f5b8
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/908-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/908-31-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/908-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/908-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/908-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/908-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/908-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/908-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2628 powershell.exe 852 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 2540 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 476 Process not Found 2896 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
pid Process 476 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2508 powercfg.exe 2524 powercfg.exe 1224 powercfg.exe 2968 powercfg.exe 2740 powercfg.exe 2828 powercfg.exe 2920 powercfg.exe 2560 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2896 set thread context of 1852 2896 lutlgidagtja.exe 85 PID 2896 set thread context of 908 2896 lutlgidagtja.exe 90 -
resource yara_rule behavioral1/memory/908-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-25-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/908-39-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2796 sc.exe 3044 sc.exe 1900 sc.exe 2436 sc.exe 2848 sc.exe 2700 sc.exe 2852 sc.exe 1784 sc.exe 2860 sc.exe 2584 sc.exe 2912 sc.exe 1844 sc.exe 1552 sc.exe 2536 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e00c6bc8d432db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2628 powershell.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2412 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2896 lutlgidagtja.exe 852 powershell.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 2896 lutlgidagtja.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe 908 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2628 powershell.exe Token: SeShutdownPrivilege 2968 powercfg.exe Token: SeShutdownPrivilege 2920 powercfg.exe Token: SeShutdownPrivilege 2828 powercfg.exe Token: SeShutdownPrivilege 2740 powercfg.exe Token: SeDebugPrivilege 852 powershell.exe Token: SeShutdownPrivilege 2524 powercfg.exe Token: SeShutdownPrivilege 2560 powercfg.exe Token: SeShutdownPrivilege 2508 powercfg.exe Token: SeLockMemoryPrivilege 908 nslookup.exe Token: SeShutdownPrivilege 1224 powercfg.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 320 wrote to memory of 2948 320 cmd.exe 37 PID 320 wrote to memory of 2948 320 cmd.exe 37 PID 320 wrote to memory of 2948 320 cmd.exe 37 PID 2540 wrote to memory of 1396 2540 cmd.exe 64 PID 2540 wrote to memory of 1396 2540 cmd.exe 64 PID 2540 wrote to memory of 1396 2540 cmd.exe 64 PID 3036 wrote to memory of 2868 3036 cmd.exe 74 PID 3036 wrote to memory of 2868 3036 cmd.exe 74 PID 3036 wrote to memory of 2868 3036 cmd.exe 74 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 1852 2896 lutlgidagtja.exe 85 PID 2896 wrote to memory of 908 2896 lutlgidagtja.exe 90 PID 2896 wrote to memory of 908 2896 lutlgidagtja.exe 90 PID 2896 wrote to memory of 908 2896 lutlgidagtja.exe 90 PID 2896 wrote to memory of 908 2896 lutlgidagtja.exe 90 PID 2896 wrote to memory of 908 2896 lutlgidagtja.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe"C:\Users\Admin\AppData\Local\Temp\ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2412 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2948
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2796
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2848
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2700
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2852
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3044
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:1784
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:2860
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2436
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:1900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1396
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2868
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2912
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1844
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2584
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1552
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2536
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1852
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD570658e51f1df013fd7eeae4ee5b03ec0
SHA12c0ce8645a3662ff5f5bc1949b5847c54c5adea0
SHA256ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786
SHA512ec758b1992827c557c20bb532e8824a629ff9a40a8bd7c8f1b7d42f68806fbe68ded062f8a8462da0c768129fef546dd8df73c004e1c2fbd1b2a38ad55b1f5b8