e12abacd392970ecd60e3ef32eaad5d17377b29be257ef2a2a1bd4cd2eda6176 | Triage

Analysis

max time kernel
30s
max time network
144s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31-12-2022 23:24

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/start.cmd
Size

29B
MD5

6eb783bc229f92d0f8285500928ac8a1
SHA1

c2740b6e8a535176e3df92c0417ef1a4d5e1bc46
SHA256

9554e811347798d784bbe0ed5fa212e95dc8783a34cbc298454805f0988cb577
SHA512

f9019e39e93f627873a9def844f4f8bce8cc49f0b757181bd2c06b30d24b75332ffc921d073f2c2481794a5cf0d507564e265e5e40585e090105b882873b1575

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1120	xmrig.exe
Token: SeLockMemoryPrivilege	1120	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1120	1808	cmd.exe	29
PID 1808 wrote to memory of 1120	1808	cmd.exe	29
PID 1808 wrote to memory of 1120	1808	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-55-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/1120-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download
memory/1120-57-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download