Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2024 15:50
Static task
static1
Behavioral task
behavioral1
Sample
414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe
Resource
win7-20241010-en
General
-
Target
414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe
-
Size
2.5MB
-
MD5
ee26108b32d7b5e5c1f47e51fd11dba2
-
SHA1
0744a751814fe469254d4d8336f32243f8e1b395
-
SHA256
414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b
-
SHA512
cf9dd0018b0c6e3c0358455ed8d6544b0acc4b5e499fc106dcca76529edfbca473ddf3b683013eee426852a6e6abf0f5f72d475d6c22b739f78d7c50c4d4f53c
-
SSDEEP
49152:Vx7T+hZhCasw5syglLJfRY3cSBfqzfp8iu390S8IZKO6Ny:fuZ8Bisy6ZHSpqrpnu39DLj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/548-62-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/548-61-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/548-65-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/548-67-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/548-66-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/548-68-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/548-64-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/548-69-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/548-70-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4044 powershell.exe 2180 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 1632 atpljrtdlbzl.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4116 powercfg.exe 1740 powercfg.exe 3916 powercfg.exe 3504 powercfg.exe 1384 powercfg.exe 3628 powercfg.exe 1240 powercfg.exe 3752 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe atpljrtdlbzl.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1632 set thread context of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 set thread context of 548 1632 atpljrtdlbzl.exe 123 -
resource yara_rule behavioral2/memory/548-57-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-58-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-62-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-60-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-59-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-61-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-56-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-65-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-67-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-66-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-68-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-64-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-69-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/548-70-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2716 sc.exe 5060 sc.exe 3272 sc.exe 1440 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 4044 powershell.exe 4044 powershell.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 3280 414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe 1632 atpljrtdlbzl.exe 2180 powershell.exe 2180 powershell.exe 1632 atpljrtdlbzl.exe 1632 atpljrtdlbzl.exe 1632 atpljrtdlbzl.exe 1632 atpljrtdlbzl.exe 1632 atpljrtdlbzl.exe 1632 atpljrtdlbzl.exe 1632 atpljrtdlbzl.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe 548 svchost.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4044 powershell.exe Token: SeShutdownPrivilege 3628 powercfg.exe Token: SeCreatePagefilePrivilege 3628 powercfg.exe Token: SeShutdownPrivilege 3504 powercfg.exe Token: SeCreatePagefilePrivilege 3504 powercfg.exe Token: SeShutdownPrivilege 1384 powercfg.exe Token: SeCreatePagefilePrivilege 1384 powercfg.exe Token: SeShutdownPrivilege 3916 powercfg.exe Token: SeCreatePagefilePrivilege 3916 powercfg.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeShutdownPrivilege 1240 powercfg.exe Token: SeCreatePagefilePrivilege 1240 powercfg.exe Token: SeShutdownPrivilege 3752 powercfg.exe Token: SeCreatePagefilePrivilege 3752 powercfg.exe Token: SeShutdownPrivilege 4116 powercfg.exe Token: SeCreatePagefilePrivilege 4116 powercfg.exe Token: SeShutdownPrivilege 1740 powercfg.exe Token: SeCreatePagefilePrivilege 1740 powercfg.exe Token: SeLockMemoryPrivilege 548 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2448 wrote to memory of 1196 2448 cmd.exe 97 PID 2448 wrote to memory of 1196 2448 cmd.exe 97 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 1376 1632 atpljrtdlbzl.exe 117 PID 1632 wrote to memory of 548 1632 atpljrtdlbzl.exe 123 PID 1632 wrote to memory of 548 1632 atpljrtdlbzl.exe 123 PID 1632 wrote to memory of 548 1632 atpljrtdlbzl.exe 123 PID 1632 wrote to memory of 548 1632 atpljrtdlbzl.exe 123 PID 1632 wrote to memory of 548 1632 atpljrtdlbzl.exe 123 PID 4772 wrote to memory of 2228 4772 cmd.exe 124 PID 4772 wrote to memory of 2228 4772 cmd.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe"C:\Users\Admin\AppData\Local\Temp\414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3280 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1196
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QVYJPHJR"2⤵
- Launches sc.exe
PID:5060
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QVYJPHJR" binpath= "C:\ProgramData\zccfxwzedpps\atpljrtdlbzl.exe" start= "auto"2⤵
- Launches sc.exe
PID:3272
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2716
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QVYJPHJR"2⤵
- Launches sc.exe
PID:1440
-
-
C:\ProgramData\zccfxwzedpps\atpljrtdlbzl.exeC:\ProgramData\zccfxwzedpps\atpljrtdlbzl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2228
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1376
-
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5ee26108b32d7b5e5c1f47e51fd11dba2
SHA10744a751814fe469254d4d8336f32243f8e1b395
SHA256414d3083ff99da1b26c198f1bcea1b5824f8a083fd57420781e21e539b5bbf1b
SHA512cf9dd0018b0c6e3c0358455ed8d6544b0acc4b5e499fc106dcca76529edfbca473ddf3b683013eee426852a6e6abf0f5f72d475d6c22b739f78d7c50c4d4f53c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82