xmrig | hxxps://github[.]com/monoxzyco/xmrig-scripts/raw/main/windows[.]ps1

Resubmissions

12/07/2024, 23:12

240712-268lhaxbqf 10

12/07/2024, 23:12

240712-26xh8svcrm 6

12/07/2024, 21:39

240712-1hzs1s1enj 10

Analysis

max time kernel
1630s
max time network
1801s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
12/07/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/monoxzyco/xmrig-scripts/raw/main/windows.ps1

Score

10^/10

xmrig execution miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/0x000100000002ab0d-207.dat	family_xmrig
behavioral1/files/0x000100000002ab0d-207.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
12	3828	powershell.exe
13	3828	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1240	xmrig.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3828	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133652940781328884"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\Registry\User\S-1-5-21-2087971895-212656400-463594913-1000_Classes\NotificationData	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e80aba36ff8d270c74f9c99fcbf05467f3a260001002600efbe1100000092d3728420d2da0161b41c8720d2da01a4ae7cc320d2da0114000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Videos"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\1af3dd05-fcf6-40e5-9454-4424803d652e.tmp:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4968	chrome.exe
4968	chrome.exe
3828	powershell.exe
3828	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe
Token: SeShutdownPrivilege	4968	chrome.exe
Token: SeCreatePagefilePrivilege	4968	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
1240	xmrig.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe
4968	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1140	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2848	4968	chrome.exe	78
PID 4968 wrote to memory of 2848	4968	chrome.exe	78
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 244	4968	chrome.exe	79
PID 4968 wrote to memory of 2072	4968	chrome.exe	80
PID 4968 wrote to memory of 2072	4968	chrome.exe	80
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81
PID 4968 wrote to memory of 4444	4968	chrome.exe	81

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/monoxzyco/xmrig-scripts/raw/main/windows.ps1
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf8e6cc40,0x7ffaf8e6cc4c,0x7ffaf8e6cc58
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2052,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3564,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3448,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4752,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4324,i,12957257631461513731,913088492907288491,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4392

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Videos\windows.ps1'"
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3828
- C:\Users\Admin\Videos\xmrig\xmrig-6.21.3\xmrig.exe
  "C:\Users\Admin\Videos\xmrig\xmrig-6.21.3\xmrig.exe" -o xmrpool.eu:3333 -u 88tYpqdgCC1da3kLmaVyZhEUndHhuTQH2d1wnA7uPKLHaA5Ri9tU8pmR7SMuhR7emSDLRYnjUkTouQDkU4jr8UFwJawxoxs --cpu-priority 8
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
eec89d6f9e0b0fbf2481e42c20f39235

SHA1
6f666208b2cafcb97c87a3f3782acb338956080e

SHA256
d073f4b2229ac1d925889d3322a8e3c448b89d7ea47db15dde020d90ec0efb8c

SHA512
0d5a91c1804e803797b4cc0c9951d81b6fb7b62f3419252366f648b4e2d6fe545f93a5e224082e67a2cabad72d2d6b665169b6d792d086b56e622f7f7e14024d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
ce1a06d0a5e1ad5f6059162e5faad420

SHA1
e38206ffd1a7d63f13b60b934f67d72287a4c354

SHA256
3601717279b68d5a479f283c752b141e5120902e6880295922c3191b026dbef4

SHA512
41a69a0527ad01a1d2b346b70726fd99377192c6ac0e536a8c375908b9a9f62716a854ce91c3fdcac4cca89eb697b462c2ddee3b6b1f28da512e1a358cecd77d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
daff62ca3ee91a65506e7431b5a33135

SHA1
88b5cdabfbae18f6068ebf3d6d1a823f82940dea

SHA256
4f399c641006c63757cf6e092e3ebbb5ee1d298f880022df5c32edae1b30cdfd

SHA512
cf7eb4bc7bff2b21dab0c5f456b2b89f12d4be326f228e9e54bd71bde35d4341075e0a2b72f3df727380d7250f8fcf0e43956725699171618cb643a3550466f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
65588466228930e4ff1346a582044eb0

SHA1
d63195008ac82a6612f4b4df3df7b1f9764cb8f6

SHA256
b66d21d59f7f6fe3d7ba60ded6e881199422463a2d6f390a9fff064f6262d15b

SHA512
6a3450540958c0d3f3568e166115f417603e15d2239df2c4d93af9db5af32074c5a03dc36aa1d9b76f30348acfee8e4225774b72b0acaf7df190bccede242bc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a6c8fe525bc4a163d8e163456e329265

SHA1
5c3cf67de56ca840b323a7a805e34fca7aca1aa1

SHA256
7a2772cd32185f3a954ba1b799722acf55fad5ff76ef457c1655c00770eb9b52

SHA512
d75f934c176d56824bdfc4e590afbe2f2615819cb51749409f505480ad285095df99a5a84d61b9dc064c287293e97e35bd14e623005301195c2b6a5e6b9f5b59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d2be01cb1ac9b9466a66a8b8d72658cf

SHA1
3fc6d7cfc96c3e81fe5b7d542f857c124780aca0

SHA256
a5a936e645a768ef6b5639ea66e77ac11df8bc062e4e03a22931edc4b4ff84ea

SHA512
dd13b54ff61ef5c85c0fbf118e7263ea401c0b2e456b429d75ab395e2f0ba0f76d9aeab4215b52ff156144d5dad511d05028e372351e761216a7e3f0803c412c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
091a25dce41d12481c17fc380842da00

SHA1
41e75434ec7ee46b6984452f5f1b3e05acf2a754

SHA256
87caf4a75ef4dc0ae55d2eb77b311aacf18eae828dcfd202c949af4646b96fee

SHA512
f9cda58783d35263d998ff8ce68cd691796438d843d0cd8814fafe349d4881bff57ebbe013589f294fbb2afe16f6d30234ed03e3380b82444f6ad0529bef8098

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
32475cf29359ca30100d61b4d1bb52d4

SHA1
847483011629b245c3fcdca7978048d32d36d0fe

SHA256
1f8ab7ccc7401bf2320824c0d528011a81dff0d2f929ef6067f5007277aedcb0

SHA512
b5de774bf46274a9cdde9e63b7c48c74b80b3cdb87c5fe945f6d190aceea7acfb31c7214ca8c7363892ba4cb6d5d53fecf0e5175f001a604a6f6d448b26d8f1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
952ad46c545eb464a738f3c2ec7f4f89

SHA1
f650500f5866cbf294e49a662586af4d8b3c8807

SHA256
cda0b588323b03236b97dd9d204dd0769e09450d7666af6fbb897a7e47f4c47d

SHA512
3366ec1af666350086e96373753cfc1cfc6e9849c8751c60961476b80421a5369e7765a9b01de242351052d0e8281f495a6bc23bc661888c89cb735e5768fdb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
5121c35c55af177d4e6d4b4985740000

SHA1
06926c638530809041451076f56f4caf0c461e45

SHA256
5a86f12c535c379ae96a4bdaf8d7d0565fe0dd8a5cc549bb3b6512a958f61f3f

SHA512
44f774f043cccb021cd459444473b79a6d3cd268875df550f395f32fe790f08de1eb2714bb4999ca6c524f813fc742749d2410ad2d60225132a439b6896795e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1af3dd05-fcf6-40e5-9454-4424803d652e.tmp

Filesize
321B

MD5
fbbad21c54e05af6deb8f2a0fcdd7a2c

SHA1
2a53ecf9249d4d9f00af128583a29b6512050cc7

SHA256
827b3d0c432d8a958eec33235ebfeea1582ca37b0b530956197bc281459d4b84

SHA512
8883f06b3dfb49e82c5da718ba495036741589052af0aba9ee143677d6b2e91554ee17364299845a42f915ea7ea6b4096013680985fb2d77d4a0952b23007b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1af3dd05-fcf6-40e5-9454-4424803d652e.tmp:Zone.Identifier

Filesize
110B

MD5
86ebbd6f2bc2c0ad3bed2139f0e0c4a4

SHA1
6dc2a474ac58e48bfadc75fa58f5b8c68dd607e7

SHA256
225120cfc6bd3326d4ac674082f3cb024d39c00e5b8a0594842a9363aa13ab88

SHA512
c9b856e89182a7b3e99a97d24c30bb8c38fbea3b4b01c1e8fbbf0efb162c22f6ba6a88ce05c5a393f9987eb92f7bbe426fe71d99c1f0ad0c5017823285d2dfb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgpy5mhm.elk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Videos\xmrig\xmrig-6.21.3\xmrig.exe

Filesize
6.1MB

MD5
c0f8959614ae06561216158d78a787e5

SHA1
73167d1fd0cee1c96a6505606d21cbfe4369eb00

SHA256
e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0

SHA512
a24fcf344d08c64ac301d5e4979f062b5e28e8e4acf1d2790916149ffe7726b0c4a11e0775aeba6b841d2d5081e1bd13e2b80390bf9bfbc44d67e54ec07cd746

Download Submit
memory/1240-209-0x000001F036D60000-0x000001F036D80000-memory.dmp

Filesize
128KB

Download
memory/3828-91-0x00007FFAE2F10000-0x00007FFAE39D2000-memory.dmp

Filesize
10.8MB

Download
memory/3828-90-0x00007FFAE2F10000-0x00007FFAE39D2000-memory.dmp

Filesize
10.8MB

Download
memory/3828-82-0x000001BD31740000-0x000001BD31762000-memory.dmp

Filesize
136KB

Download
memory/3828-79-0x00007FFAE2F13000-0x00007FFAE2F15000-memory.dmp

Filesize
8KB

Download
memory/3828-181-0x000001BD49DB0000-0x000001BD49DC2000-memory.dmp

Filesize
72KB

Download
memory/3828-182-0x000001BD49B50000-0x000001BD49B5A000-memory.dmp

Filesize
40KB

Download
memory/3828-89-0x00007FFAE2F10000-0x00007FFAE39D2000-memory.dmp

Filesize
10.8MB

Download
memory/3828-210-0x00007FFAE2F10000-0x00007FFAE39D2000-memory.dmp

Filesize
10.8MB

Download
memory/3828-212-0x00007FFAE2F13000-0x00007FFAE2F15000-memory.dmp

Filesize
8KB

Download
memory/3828-213-0x00007FFAE2F10000-0x00007FFAE39D2000-memory.dmp

Filesize
10.8MB

Download