8b9742058d345a0ac449342d71972b9b4720060d6d4f88eceb78043ed369faa2

Analysis

max time kernel
447s
max time network
1048s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 13:29

Target

BusinessWorkeris/start - Copy (10).cmd
Size

209B
MD5

bdf5baf194642b2402075d0c7ac80c0d
SHA1

aa7d04dc7adeb0070a2b888b95e81251f53d7fbf
SHA256

f9cf5dbed1faa657d890d4c48f7f1478d1d3565f1ac5bd038c1386f5ef306fd9
SHA512

fad8346c0a8bf52a1caf8ed2919c678b5e942b7661062862a771aa042ed57f136546ed5e5bf643e771682e5d1d90f68c81ea950cac80183f3d8fb9c1b2a955e1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3080	xmrig.exe
Token: SeLockMemoryPrivilege	3080	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3080	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 3080	1560	cmd.exe	85
PID 1560 wrote to memory of 3080	1560	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BusinessWorkeris\start - Copy (10).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\BusinessWorkeris\xmrig.exe
  xmrig.exe --donate-level 1 -o de.monero.herominers.com:1111 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p aloneworkeris -a rx/0 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3080

memory/3080-0-0x000001AEB4370000-0x000001AEB4390000-memory.dmp

Filesize
128KB

Download
memory/3080-1-0x000001AEB43C0000-0x000001AEB43E0000-memory.dmp

Filesize
128KB

Download
memory/3080-3-0x000001AEB4400000-0x000001AEB4420000-memory.dmp

Filesize
128KB

Download
memory/3080-2-0x000001AEB43E0000-0x000001AEB4400000-memory.dmp

Filesize
128KB

Download
memory/3080-5-0x000001AEB4400000-0x000001AEB4420000-memory.dmp

Filesize
128KB

Download
memory/3080-4-0x000001AEB43E0000-0x000001AEB4400000-memory.dmp

Filesize
128KB

Download