Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
04/01/2024, 10:21
General
-
Target
pdfeditor/start.cmd
-
Size
48B
-
MD5
7a5f44ef0fcb9b3b66c65fc36aabf0af
-
SHA1
76887427c1a843b35de8920f93fa744b1abb5a67
-
SHA256
56cc2f42fb9967cb986ce44a3530481f2c4f6e79a935e829a8285d023b820763
-
SHA512
5a128e128e1ebb2c5c265f0dcded63f818ae9d7ac11cd5c10cf89fdebf7ccae5fe78a725ef96aeb6235db396cecbe86d43b2a15b7228f966cd55b7119d7e2490
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 14 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pdfeditor\start.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pdfeditor\pdfeditor.exepdfeditor.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
-
Filesize
256KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB