2e55752a5ce424f78521951780658ea572e78920fab1980c5047eb543d3dbec8 | Triage

Analysis

max time kernel
1711s
max time network
1585s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2023 19:16

Sharing

Report Analysis Logs

General

Target

SysApps/start.cmd
Size

102B
MD5

b16db6e30e95f6bfdda6855e24e89452
SHA1

ed88e3c582a1442de870cf8bc308883d06864607
SHA256

ba9d55198ba50f3cbad464d29414feb17037e8de0dd1d048a8c0103d1142e750
SHA512

2dc8372df56ede3d652f51d8947165698c7d33aa8b6ac14785ea52645f6f3699d2e824e0590fc81f7dcf16095c71d97d020abc3b471eb730e4306d291f8c10fb

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{34FEE6BD-1E8D-41D9-8020-A06A048DE9BE}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E7894E2F-7F86-4457-859A-ABAE36BED084}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3200	powershell.exe
3200	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3200	2692	cmd.exe	77
PID 2692 wrote to memory of 3200	2692	cmd.exe	77

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SysApps\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Start-Process -WindowStyle hidden C:\Windows\System32\SysApps\xmrig.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-133-0x000001AD78840000-0x000001AD78862000-memory.dmp

Filesize
136KB

Download
memory/3200-134-0x00007FF8A1980000-0x00007FF8A2441000-memory.dmp

Filesize
10.8MB

Download
memory/3200-135-0x00007FF8A1980000-0x00007FF8A2441000-memory.dmp

Filesize
10.8MB

Download