ca610938fbce79e1b39d0be34db05b71515c803ee347251f202df9c09dbc3ff4

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 03:32

Target

cz-x1/start.cmd
Size

44B
MD5

eaf3a00cc0465f8af471b849ada29843
SHA1

3042e97874706189aa9704d77c9e74a94e519106
SHA256

8e70ef38fe14a2ee2848df3d6f7e260d1caf8cfc15de694d678b8af151d62333
SHA512

56b9f3991ae4bad5e06097d095931e746e6b2ac955649a5c793d9f4f6861c6ffc9316b063c34d7a8079af201354c87bf3008bc0fd4321e59b27e1d8120b078cf

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3016	xmrig.exe
Token: SeLockMemoryPrivilege	3016	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3016	2596	cmd.exe	32
PID 2596 wrote to memory of 3016	2596	cmd.exe	32
PID 2596 wrote to memory of 3016	2596	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cz-x1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\cz-x1\xmrig.exe
  xmrig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3016

memory/3016-0-0x0000000000180000-0x00000000001A0000-memory.dmp

Filesize
128KB

Download
memory/3016-3-0x0000000002170000-0x0000000002190000-memory.dmp

Filesize
128KB

Download
memory/3016-2-0x0000000002150000-0x0000000002170000-memory.dmp

Filesize
128KB

Download
memory/3016-5-0x0000000002170000-0x0000000002190000-memory.dmp

Filesize
128KB

Download
memory/3016-4-0x0000000002150000-0x0000000002170000-memory.dmp

Filesize
128KB

Download