Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2024 03:32

General

  • Target

    cz-x17/start.cmd

  • Size

    44B

  • MD5

    eaf3a00cc0465f8af471b849ada29843

  • SHA1

    3042e97874706189aa9704d77c9e74a94e519106

  • SHA256

    8e70ef38fe14a2ee2848df3d6f7e260d1caf8cfc15de694d678b8af151d62333

  • SHA512

    56b9f3991ae4bad5e06097d095931e746e6b2ac955649a5c793d9f4f6861c6ffc9316b063c34d7a8079af201354c87bf3008bc0fd4321e59b27e1d8120b078cf

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cz-x17\start.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\cz-x17\xmrig.exe
      xmrig.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5032-0-0x0000024578BD0000-0x0000024578BF0000-memory.dmp

    Filesize

    128KB

  • memory/5032-2-0x000002460AD50000-0x000002460AD70000-memory.dmp

    Filesize

    128KB

  • memory/5032-4-0x000002460B190000-0x000002460B1B0000-memory.dmp

    Filesize

    128KB

  • memory/5032-3-0x000002460B3C0000-0x000002460B3E0000-memory.dmp

    Filesize

    128KB

  • memory/5032-6-0x000002460B190000-0x000002460B1B0000-memory.dmp

    Filesize

    128KB

  • memory/5032-5-0x000002460B3C0000-0x000002460B3E0000-memory.dmp

    Filesize

    128KB