8b9742058d345a0ac449342d71972b9b4720060d6d4f88eceb78043ed369faa2

Analysis

max time kernel
473s
max time network
548s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 13:29

Target

BusinessWorkeris/start - Copy (5).cmd
Size

209B
MD5

bdf5baf194642b2402075d0c7ac80c0d
SHA1

aa7d04dc7adeb0070a2b888b95e81251f53d7fbf
SHA256

f9cf5dbed1faa657d890d4c48f7f1478d1d3565f1ac5bd038c1386f5ef306fd9
SHA512

fad8346c0a8bf52a1caf8ed2919c678b5e942b7661062862a771aa042ed57f136546ed5e5bf643e771682e5d1d90f68c81ea950cac80183f3d8fb9c1b2a955e1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3276	xmrig.exe
Token: SeLockMemoryPrivilege	3276	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3276	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 3276	3580	cmd.exe	91
PID 3580 wrote to memory of 3276	3580	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BusinessWorkeris\start - Copy (5).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Users\Admin\AppData\Local\Temp\BusinessWorkeris\xmrig.exe
  xmrig.exe --donate-level 1 -o de.monero.herominers.com:1111 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p aloneworkeris -a rx/0 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4060,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
1⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1320,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
1⤵
PID:4200

memory/3276-0-0x00000200104F0000-0x0000020010510000-memory.dmp

Filesize
128KB

Download
memory/3276-1-0x0000020011E20000-0x0000020011E40000-memory.dmp

Filesize
128KB

Download
memory/3276-2-0x0000020011E40000-0x0000020011E60000-memory.dmp

Filesize
128KB

Download
memory/3276-3-0x0000020011E70000-0x0000020011E90000-memory.dmp

Filesize
128KB

Download
memory/3276-4-0x0000020011E40000-0x0000020011E60000-memory.dmp

Filesize
128KB

Download
memory/3276-5-0x0000020011E70000-0x0000020011E90000-memory.dmp

Filesize
128KB

Download