8b9742058d345a0ac449342d71972b9b4720060d6d4f88eceb78043ed369faa2

Analysis

max time kernel
1038s
max time network
1048s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 13:29

Target

BusinessWorkeris/start - Copy (3).cmd
Size

209B
MD5

bdf5baf194642b2402075d0c7ac80c0d
SHA1

aa7d04dc7adeb0070a2b888b95e81251f53d7fbf
SHA256

f9cf5dbed1faa657d890d4c48f7f1478d1d3565f1ac5bd038c1386f5ef306fd9
SHA512

fad8346c0a8bf52a1caf8ed2919c678b5e942b7661062862a771aa042ed57f136546ed5e5bf643e771682e5d1d90f68c81ea950cac80183f3d8fb9c1b2a955e1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1996	xmrig.exe
Token: SeLockMemoryPrivilege	1996	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1996	2696	cmd.exe	84
PID 2696 wrote to memory of 1996	2696	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BusinessWorkeris\start - Copy (3).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\BusinessWorkeris\xmrig.exe
  xmrig.exe --donate-level 1 -o de.monero.herominers.com:1111 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p aloneworkeris -a rx/0 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1996

memory/1996-0-0x0000029104A60000-0x0000029104A80000-memory.dmp

Filesize
128KB

Download