Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe
Resource
win7-20240903-en
General
-
Target
414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe
-
Size
2.5MB
-
MD5
ee26108b32d7b5e5c1f47e51fd11dba2
-
SHA1
0744a751814fe469254d4d8336f32243f8e1b395
-
SHA256
414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b
-
SHA512
cf9dd0018b0c6e3c0358455ed8d6544b0acc4b5e499fc106dcca76529edfbca473ddf3b683013eee426852a6e6abf0f5f72d475d6c22b739f78d7c50c4d4f53c
-
SSDEEP
49152:Vx7T+hZhCasw5syglLJfRY3cSBfqzfp8iu390S8IZKO6Ny:fuZ8Bisy6ZHSpqrpnu39DLj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/492-34-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/492-33-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/492-37-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/492-40-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/492-39-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/492-38-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/492-36-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/492-41-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/492-42-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2128 powershell.exe 2776 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 2 IoCs
pid Process 472 Process not Found 2156 atpljrtdlbzl.exe -
Loads dropped DLL 1 IoCs
pid Process 472 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1468 powercfg.exe 2992 powercfg.exe 2536 powercfg.exe 2432 powercfg.exe 2252 powercfg.exe 2908 powercfg.exe 2324 powercfg.exe 2528 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe atpljrtdlbzl.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2156 set thread context of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 set thread context of 492 2156 atpljrtdlbzl.exe 64 -
resource yara_rule behavioral1/memory/492-34-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-33-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-32-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-31-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-37-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-27-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-40-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-39-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-38-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-26-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-30-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-36-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-41-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/492-42-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2948 sc.exe 2764 sc.exe 2904 sc.exe 2916 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 70752c965f39db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 2128 powershell.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1800 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 2156 atpljrtdlbzl.exe 2776 powershell.exe 2156 atpljrtdlbzl.exe 2156 atpljrtdlbzl.exe 2156 atpljrtdlbzl.exe 2156 atpljrtdlbzl.exe 2156 atpljrtdlbzl.exe 2156 atpljrtdlbzl.exe 2156 atpljrtdlbzl.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe 492 svchost.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2128 powershell.exe Token: SeShutdownPrivilege 2992 powercfg.exe Token: SeShutdownPrivilege 2528 powercfg.exe Token: SeShutdownPrivilege 1468 powercfg.exe Token: SeShutdownPrivilege 2536 powercfg.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeShutdownPrivilege 2324 powercfg.exe Token: SeShutdownPrivilege 2252 powercfg.exe Token: SeLockMemoryPrivilege 492 svchost.exe Token: SeShutdownPrivilege 2908 powercfg.exe Token: SeShutdownPrivilege 2432 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2928 2384 cmd.exe 44 PID 2384 wrote to memory of 2928 2384 cmd.exe 44 PID 2384 wrote to memory of 2928 2384 cmd.exe 44 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 2396 2156 atpljrtdlbzl.exe 59 PID 2156 wrote to memory of 492 2156 atpljrtdlbzl.exe 64 PID 2156 wrote to memory of 492 2156 atpljrtdlbzl.exe 64 PID 2156 wrote to memory of 492 2156 atpljrtdlbzl.exe 64 PID 2156 wrote to memory of 492 2156 atpljrtdlbzl.exe 64 PID 2156 wrote to memory of 492 2156 atpljrtdlbzl.exe 64 PID 2732 wrote to memory of 1652 2732 cmd.exe 66 PID 2732 wrote to memory of 1652 2732 cmd.exe 66 PID 2732 wrote to memory of 1652 2732 cmd.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe"C:\Users\Admin\AppData\Local\Temp\414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1800 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2928
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QVYJPHJR"2⤵
- Launches sc.exe
PID:2948
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QVYJPHJR" binpath= "C:\ProgramData\zccfxwzedpps\atpljrtdlbzl.exe" start= "auto"2⤵
- Launches sc.exe
PID:2764
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2916
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QVYJPHJR"2⤵
- Launches sc.exe
PID:2904
-
-
C:\ProgramData\zccfxwzedpps\atpljrtdlbzl.exeC:\ProgramData\zccfxwzedpps\atpljrtdlbzl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:1652
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2396
-
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5ee26108b32d7b5e5c1f47e51fd11dba2
SHA10744a751814fe469254d4d8336f32243f8e1b395
SHA256414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b
SHA512cf9dd0018b0c6e3c0358455ed8d6544b0acc4b5e499fc106dcca76529edfbca473ddf3b683013eee426852a6e6abf0f5f72d475d6c22b739f78d7c50c4d4f53c