8b9742058d345a0ac449342d71972b9b4720060d6d4f88eceb78043ed369faa2

Analysis

max time kernel
839s
max time network
1042s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 13:29

Target

BusinessWorkeris/start - Copy (13).cmd
Size

209B
MD5

bdf5baf194642b2402075d0c7ac80c0d
SHA1

aa7d04dc7adeb0070a2b888b95e81251f53d7fbf
SHA256

f9cf5dbed1faa657d890d4c48f7f1478d1d3565f1ac5bd038c1386f5ef306fd9
SHA512

fad8346c0a8bf52a1caf8ed2919c678b5e942b7661062862a771aa042ed57f136546ed5e5bf643e771682e5d1d90f68c81ea950cac80183f3d8fb9c1b2a955e1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1672	xmrig.exe
Token: SeLockMemoryPrivilege	1672	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1672	2312	cmd.exe	29
PID 2312 wrote to memory of 1672	2312	cmd.exe	29
PID 2312 wrote to memory of 1672	2312	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BusinessWorkeris\start - Copy (13).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\BusinessWorkeris\xmrig.exe
  xmrig.exe --donate-level 1 -o de.monero.herominers.com:1111 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p aloneworkeris -a rx/0 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1672

memory/1672-0-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/1672-2-0x0000000002160000-0x0000000002180000-memory.dmp

Filesize
128KB

Download
memory/1672-1-0x0000000002140000-0x0000000002160000-memory.dmp

Filesize
128KB

Download
memory/1672-4-0x0000000002160000-0x0000000002180000-memory.dmp

Filesize
128KB

Download
memory/1672-3-0x0000000002140000-0x0000000002160000-memory.dmp

Filesize
128KB

Download