437e1e9d471118c296359bcfc1d6b3a197d36d11e37727a380ef7a09632509d9 | Triage

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 02:44

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/benchmark_10M.cmd
Size

56B
MD5

14b1ce42ded2df03638180864e4d056f
SHA1

cbc1b3edd1942630f6363f3ccae574283b14c260
SHA256

bdec0d2ea20decc25659f26c7bfd7a78fb0e51cc100443b8a35c43206d2eb86a
SHA512

d8297c2728245b570ad71b8062a17e28e2d9e72bf8be773bb92828e57912cdd0a6ec35fe244069a5fdaf3be8cfe3997c403ea551b81be5708dd80c6eb5f6e458

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2040	xmrig.exe
Token: SeLockMemoryPrivilege	2040	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2040	1252	cmd.exe	28
PID 1252 wrote to memory of 2040	1252	cmd.exe	28
PID 1252 wrote to memory of 2040	1252	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\benchmark_10M.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe --bench=10M --submit
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-55-0x00000000002F0000-0x0000000000310000-memory.dmp

Filesize
128KB

Download
memory/2040-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download
memory/2040-57-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download