analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | 0fe90cbcbf450589ef213aeaa34d21c0N.exe |
| Full analysis: | https://app.any.run/tasks/5d26a9fc-25dd-4895-ac7a-158cb17d0dd7 |
| Verdict: | Malicious activity |
| Threats: | Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. |
| Analysis date: | July 06, 2024, 17:41:33 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (console) x86-64, for MS Windows |
| MD5: | 0FE90CBCBF450589EF213AEAA34D21C0 |
| SHA1: | 965C7AAD70489A42D200403322B25B3CD2FCF373 |
| SHA256: | 6F038C4CCC9BC963FA9CD885135ECB439C6492F1BB39A01C015E7A2DEB5C99B7 |
| SSDEEP: | 49152:KyYi+8roHEKbEzn8qI4aL7OGXDh5Xp5BwnNtBvthc83VJZimdMkFfdk2a2yKmkUe:K6+88fmkInNtBFhc8FJZT |
MALICIOUS
Drops the executable file immediately after the start
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
XMRIG has been detected (YARA)
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Scans artifacts that could help determine the target
- powershell.exe (PID: 4724)
Connects to the CnC server
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Request a resource from the Internet using PowerShell's cmdlet
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Potential Corporate Privacy Violation
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
INFO
Checks supported languages
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Checks proxy server information
- powershell.exe (PID: 4724)
Disables trace logs
- powershell.exe (PID: 4724)
Reads the computer name
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Gets data length (POWERSHELL)
- powershell.exe (PID: 4724)
Reads Internet Explorer settings
- powershell.exe (PID: 4724)
UPX packer has been detected
- 0fe90cbcbf450589ef213aeaa34d21c0N.exe (PID: 1328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | UPX compressed Win32 Executable (87.1) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.4) |
| .exe | | | DOS Executable Generic (6.4) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2019:09:04 19:31:32+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.22 |
| CodeSize: | 540672 |
| InitializedDataSize: | 4096 |
| UninitializedDataSize: | 3588096 |
| EntryPoint: | 0x3effe0 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
Total processes
122
Monitored processes
3
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1328 | "C:\Users\admin\Desktop\0fe90cbcbf450589ef213aeaa34d21c0N.exe" | C:\Users\admin\Desktop\0fe90cbcbf450589ef213aeaa34d21c0N.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 3052 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4724 | powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" " | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
7 246
Read events
7 221
Write events
25
Delete events
0
Modification events
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (4724) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
0
Suspicious files
8
Text files
103
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_koqmmmpl.tqn.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\global-526475a50099[1].css | text | |
MD5:1D84A1218AC4D2D6FA58318B710FE1C2 | SHA256:8336CF6CBCD22D18CF68EEDB45141E5724C1C9BFCE2FAA71267C528B79D0C085 | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\primer-primitives-8500c2c7ce5f[1].css | text | |
MD5:E9C08B9BA681AD6606BD18F264E73EF6 | SHA256:B08C9718118F5B814E632AC3DC0D8E009E5DC2913DF183F0ED322E6817E997DF | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\dashboard-e264a87d442a[1].css | text | |
MD5:4928C91622B4AB71D3C741516CE3A27C | SHA256:595243D90FC171C6B9C6C1192A76057BA9066AB963AA6A77918070D2BC52CCCF | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\light-efd2f2257c96[1].css | text | |
MD5:B8473FDB0F4749DE99341662AEC850F2 | SHA256:8AABC55D211FC93ACB563C9CF30732577212A998196F73B067F9795C8D1EF72B | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\site-3ab44dbdb8a0[1].css | text | |
MD5:6898D881FB9B6758FB5A65B3B9FAC739 | SHA256:2BB851AA74118BB53F44AE8BA20C228638AA5D08DFDE84581A3D67FCFEC05B7D | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\dark-6b1e37da2254[1].css | text | |
MD5:96BA1DEB375C1C66BB092FA0A1765BE1 | SHA256:D6BC29D6A4E33C7F4DA1D4B8060CCE6DEDF384D7334B71661C277E985EF8C156 | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fygeeohz.5ib.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-03bcda509ec9[1].js | text | |
MD5:9C0205FABB4F94DCA52960B723FC5109 | SHA256:D7C92CB4874D08BC420AB20D970C0EF1C5F26E42CEA345CFCCF4AB5653EC219E | |||
| 4724 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\environment-a36e9a1c67ad[1].js | text | |
MD5:FE5E77781F5E74AC7EDFA1020DB49504 | SHA256:B563AA76B8D16D0725359ED03A55D4EBF733FAB6A192456D1F1F56BAD6CDC2CE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
117
TCP/UDP connections
33
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 301 | 140.82.121.3:443 | https://raw.githubusercontent.com/ | unknown | — | — | — |
4456 | RUXIMICS.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
188 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
1776 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
188 | svchost.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
1776 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
— | — | GET | 200 | 185.199.109.154:443 | https://github.githubassets.com/assets/global-526475a50099.css | unknown | text | 282 Kb | — |
— | — | GET | 200 | 185.199.111.154:443 | https://github.githubassets.com/assets/discussions-9d3cffcbc704.css | unknown | text | 4.96 Kb | — |
— | — | GET | 200 | 185.199.108.154:443 | https://github.githubassets.com/assets/dashboard-e264a87d442a.css | unknown | text | 9.56 Kb | — |
— | — | GET | 200 | 185.199.110.154:443 | https://github.githubassets.com/assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_details-d-ed9a97-dfdebffa4a55.js | unknown | binary | 17.9 Kb | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | 3.120.98.217:8080 | — | AMAZON-02 | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4456 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
1776 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
188 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
188 | svchost.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4032 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1776 | MoUsoCoreWorker.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4456 | RUXIMICS.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4724 | powershell.exe | 185.199.110.133:443 | raw.githubusercontent.com | FASTLY | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
raw.githubusercontent.com |
| shared |
www.microsoft.com |
| whitelisted |
github.com |
| shared |
settings-win.data.microsoft.com |
| whitelisted |
github.githubassets.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to access raw user content on GitHub |
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
— | — | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
1328 | 0fe90cbcbf450589ef213aeaa34d21c0N.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |