Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 19:55
General
- Target static-Office365.exe
- Size 12.8MB
- Sample260916-yncjkavepb
- SHA256 277b73d7981302c0da84c9656c8c5e132929d433aa8485b288ba7c5397b4b469
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 32 IoCs
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\static-Office365.exe"C:\Users\Admin\AppData\Local\Temp\static-Office365.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --config=C:\Users\Admin\AppData\Local\Temp\TCB7A3.tmp2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --config=C:\Users\Admin\AppData\Local\Temp\TCBC48.tmp2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\static-Office365.exeC:\Users\Admin\AppData\Roaming\Microsoft\static-Office365.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TCB7A3.tmp
TCB7A3.tmp
static-Office365.exe
memory/1932-42-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-26-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-52-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-50-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-15-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-48-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-38-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-36-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-46-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-28-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-30-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-32-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-44-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-34-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/1932-40-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/3936-3-0x00007FF751920000-0x00007FF7525F6000-memory.dmp
memory/4444-37-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-33-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-39-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-51-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-41-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-1-0x0000026DE7950000-0x0000026DE7951000-memory.dmp
memory/4444-43-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-27-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-45-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-35-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-47-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-23-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/4444-49-0x00007FF645380000-0x00007FF646056000-memory.dmp
memory/5860-13-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp
memory/5860-10-0x0000021B72FE0000-0x0000021B73000000-memory.dmp
memory/5860-5-0x00007FF73BA40000-0x00007FF73C1F0000-memory.dmp