437e1e9d471118c296359bcfc1d6b3a197d36d11e37727a380ef7a09632509d9 | Triage

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 02:44

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/benchmark_1M.cmd
Size

55B
MD5

4cc3ab4b68dc35959e289f4c7562e909
SHA1

c88098544439d41013eaaa7e31d2ed68ddd9c874
SHA256

8d26568f8d874053ad68dd1f4510a85ae61045e0945c33599dabd461fae7e835
SHA512

858f12ac880d4b794110ac21ca77a56933a781383a435a23b2e58d3925208f712424e691f90b1ee8a8f5c459c19969ef39a609ac4ddbcc5f4d98ed4dc1f17bb5

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1940	xmrig.exe
Token: SeLockMemoryPrivilege	1940	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1940	1664	cmd.exe	29
PID 1664 wrote to memory of 1940	1664	cmd.exe	29
PID 1664 wrote to memory of 1940	1664	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\benchmark_1M.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe --bench=1M --submit
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-55-0x0000000000500000-0x0000000000520000-memory.dmp

Filesize
128KB

Download
memory/1940-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download