| File name: | 0fe90cbcbf450589ef213aeaa34d21c0N.exe |
| Full analysis: | https://app.any.run/tasks/5d26a9fc-25dd-4895-ac7a-158cb17d0dd7 |
| Verdict: | Malicious activity |
| Threats: | Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. |
| Analysis date: | July 06, 2024, 17:41:33 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (console) x86-64, for MS Windows |
| MD5: | 0FE90CBCBF450589EF213AEAA34D21C0 |
| SHA1: | 965C7AAD70489A42D200403322B25B3CD2FCF373 |
| SHA256: | 6F038C4CCC9BC963FA9CD885135ECB439C6492F1BB39A01C015E7A2DEB5C99B7 |
| SSDEEP: | 49152:KyYi+8roHEKbEzn8qI4aL7OGXDh5Xp5BwnNtBvthc83VJZimdMkFfdk2a2yKmkUe:K6+88fmkInNtBFhc8FJZT |
MALICIOUS
Drops the executable file immediately after the start
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Scans artifacts that could help determine the target
- powershell.exe (PID: 4724)
XMRIG has been detected (YARA)
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Connects to the CnC server
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Request a resource from the Internet using PowerShell's cmdlet
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Potential Corporate Privacy Violation
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
INFO
Checks supported languages
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Reads the computer name
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Disables trace logs
- powershell.exe (PID: 4724)
Checks proxy server information
- powershell.exe (PID: 4724)
Reads Internet Explorer settings
- powershell.exe (PID: 4724)
Gets data length (POWERSHELL)
- powershell.exe (PID: 4724)
UPX packer has been detected
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | UPX compressed Win32 Executable (87.1) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.4) |
| .exe | | | DOS Executable Generic (6.4) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2019:09:04 19:31:32+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.22 |
| CodeSize: | 540672 |
| InitializedDataSize: | 4096 |
| UninitializedDataSize: | 3588096 |
| EntryPoint: | 0x3effe0 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
Total processes
122
Monitored processes
3
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1328 | "C:\Users\admin\Desktop\0fe90cbcbf450589ef213aeaa34d21c0N.exe" | C:\Users\admin\Desktop\0fe90cbcbf450589ef213aeaa34d21c0N.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 3052 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4724 | powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" " | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
7 246
Read events
7 221
Write events
25
Delete events
0
Modification events
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
0
Suspicious files
8
Text files
103
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\vendors-node_modules_github_selector-observer_dist_index_esm_js-9f960d9b217c[1].js | text | |
MD5:683A7FE431BDED8FBBF7B5189A1B8209 | SHA256:F87C5B59B8F353C8762F2E44E1F82FEAFAB882A96A0FAD135DC6FC1555872AB3 | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\site-3ab44dbdb8a0[1].css | text | |
MD5:6898D881FB9B6758FB5A65B3B9FAC739 | SHA256:2BB851AA74118BB53F44AE8BA20C228638AA5D08DFDE84581A3D67FCFEC05B7D | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\light-efd2f2257c96[1].css | text | |
MD5:B8473FDB0F4749DE99341662AEC850F2 | SHA256:8AABC55D211FC93ACB563C9CF30732577212A998196F73B067F9795C8D1EF72B | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\dark-6b1e37da2254[1].css | text | |
MD5:96BA1DEB375C1C66BB092FA0A1765BE1 | SHA256:D6BC29D6A4E33C7F4DA1D4B8060CCE6DEDF384D7334B71661C277E985EF8C156 | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\dashboard-e264a87d442a[1].css | text | |
MD5:4928C91622B4AB71D3C741516CE3A27C | SHA256:595243D90FC171C6B9C6C1192A76057BA9066AB963AA6A77918070D2BC52CCCF | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\primer-primitives-8500c2c7ce5f[1].css | text | |
MD5:E9C08B9BA681AD6606BD18F264E73EF6 | SHA256:B08C9718118F5B814E632AC3DC0D8E009E5DC2913DF183F0ED322E6817E997DF | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\github-0c7b5281bcc9[1].css | text | |
MD5:D93B35EDA2F4E99E5555C4CEA314C18B | SHA256:92C3D2D683BC4CDC52CF25451B52341558BBF6665C9C326AAD3D3C2EA0EB9372 | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\home-f57bcc4383d0[1].css | text | |
MD5:B62C6B754EB544E40FF19736D98E7236 | SHA256:98D5620368B6E0EA7DE7F5E7232FA24E66C20B81B3C8E49740DD7878F08C1E48 | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\discussions-9d3cffcbc704[1].css | text | |
MD5:4459D0FDFC5ED2870B953934786D8E24 | SHA256:23ED3D33C252B1B7E1498309F994EBC5448D5ED2D2BB48B580607517BE62B76C | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\vendors-node_modules_dompurify_dist_purify_js-810e4b1b9abd[1].js | text | |
MD5:917054FF94AF6B65EF610AA7B541865A | SHA256:3B0D2012948870AF14B480BED5535B34C5F7E649A2C9C13234C319FBF8D2D7DB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
117
TCP/UDP connections
33
DNS requests
7
Threats
17
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 301 | 140.82.121.3:443 | https://raw.githubusercontent.com/ | unknown | — | — | unknown |
4456 | RUXIMICS.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
1776 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
1776 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
188 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
188 | svchost.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
— | — | GET | 200 | 185.199.110.154:443 | https://github.githubassets.com/assets/github-0c7b5281bcc9.css | unknown | text | 124 Kb | unknown |
— | — | GET | 200 | 185.199.109.154:443 | https://github.githubassets.com/assets/global-526475a50099.css | unknown | text | 282 Kb | unknown |
— | — | GET | 200 | 185.199.110.154:443 | https://github.githubassets.com/assets/dark-6b1e37da2254.css | unknown | text | 48.3 Kb | unknown |
— | — | GET | 200 | 185.199.111.154:443 | https://github.githubassets.com/assets/primer-61560ce103d3.css | unknown | text | 333 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | 3.120.98.217:8080 | — | AMAZON-02 | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4456 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
1776 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
188 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
188 | svchost.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4032 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1776 | MoUsoCoreWorker.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4456 | RUXIMICS.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4724 | powershell.exe | 185.199.110.133:443 | raw.githubusercontent.com | FASTLY | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
raw.githubusercontent.com |
| shared |
www.microsoft.com |
| whitelisted |
github.com |
| shared |
settings-win.data.microsoft.com |
| whitelisted |
github.githubassets.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
2168 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to access raw user content on GitHub |
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |