7be187657d5fe544b8d3f70581a2abcc737b242f46292faf471f0cc21f4c8369

max time kernel
92s
max time network
267s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
07/11/2024, 08:33

Sharing

Target
PUB2/zephyr - Copie (29).bat
Size 167B
Sample241107-kfw2cayfpg
SHA256 03998abcae27f91e0dcda7ae34de839732f5a9946ea0e95238ca990d01056fa1
MD5 9cf7dcb4a62bacb2595f77bbaf3fcb73
SHA1 f1815c87e0706bf44da79b016a4f99abb2561f2c
SHA512 5c77635c70d91d3e89ed1ee39ce65af4b7055be0cdfddc9f6296443ba57c92b5943db5d05c8f2137a021074248eb924e5cf267edea942bc9123b8bb152bdd033
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3532	xmrig.exe
Token: SeLockMemoryPrivilege	3532	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3532	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3532	1100	cmd.exe	81
PID 1100 wrote to memory of 3532	1100	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (29).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
  xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p OVNI -a rx/0 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3532

memory/3532-0-0x000001F0E1690000-0x000001F0E16B0000-memory.dmp

Download

memory/3532-1-0x000001F0E2FC0000-0x000001F0E2FE0000-memory.dmp

Download

memory/3532-2-0x000001F0E2FE0000-0x000001F0E3000000-memory.dmp

Download

memory/3532-3-0x000001F0E3000000-0x000001F0E3020000-memory.dmp

Download

memory/3532-4-0x000001F0E2FE0000-0x000001F0E3000000-memory.dmp

Download

memory/3532-5-0x000001F0E3000000-0x000001F0E3020000-memory.dmp

Download