xmrig | 5c5374eb9054e48c5ab9c6ef21c2bd228fe2e63eaa0ae83dbdb65dd1a7429369

Analysis

max time kernel
900s
max time network
901s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
03/03/2025, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

miner.exe
Size

104KB
MD5

4a9f5b7664e2ebf47aa5fc4240dc8a22
SHA1

d0fc11aab0181df38d193cf8dfd1843fe06c844a
SHA256

5c5374eb9054e48c5ab9c6ef21c2bd228fe2e63eaa0ae83dbdb65dd1a7429369
SHA512

f45224b584b64d4ac32d4e6303ad87b2902ea310ac332ed0a0c7a706df2441eb0ef1f5076fe2716d004e59aa6a8e9e5e5e3a8f012008f05aef05064ad1e1eed6
SSDEEP

192:xjZaDMFEa4ajXPeeZnXwqXTyE1hEjjTyXfan55tfMcePLiZmGhTuRY9SRXiKqiRh:hp4ajGCnXGMsGXfwldJ99Sjvb99Sjv

Score

10^/10

xmrig xworm defense_evasion execution miner rat trojan

Malware Config

Extracted

Family

xworm

Mutex

yNحكـX8ٍبAGLWِF6Jo2DiObلٍLZا3ا

Attributes

Install_directory
%Port%
install_file
MicrosoftEdgeUpdateTaskMachineUAC.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4664-338-0x0000011F49340000-0x0000011F4934E000-memory.dmp	family_xworm

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/files/0x001c00000002ae4f-69.dat	family_xmrig
behavioral1/files/0x001c00000002ae4f-69.dat	xmrig
behavioral1/memory/4664-70-0x0000011F2E1C0000-0x0000011F2EB06000-memory.dmp	xmrig
behavioral1/memory/4664-226-0x0000011F49490000-0x0000011F4A0C4000-memory.dmp	xmrig
behavioral1/files/0x001900000002ae8b-253.dat	family_xmrig
behavioral1/files/0x001900000002ae8b-253.dat	xmrig

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 3 IoCs

pid	Process
4664	xmrig.exe
3792	4bqvfjv3.emx.exe
5032	fftj1v42.tfm.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk	DllHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	OfficeClickToRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4348	powershell.exe
1872	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4348	powershell.exe
4348	powershell.exe
1872	powershell.exe
1872	powershell.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe
3792	4bqvfjv3.emx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3296	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	4664	xmrig.exe
Token: SeDebugPrivilege	3792	4bqvfjv3.emx.exe
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	420	dwm.exe
Token: SeCreatePagefilePrivilege	420	dwm.exe
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	420	dwm.exe
Token: SeCreatePagefilePrivilege	420	dwm.exe
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	420	dwm.exe
Token: SeCreatePagefilePrivilege	420	dwm.exe
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE
Token: SeShutdownPrivilege	3296	Explorer.EXE
Token: SeCreatePagefilePrivilege	3296	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3792	4bqvfjv3.emx.exe
5032	fftj1v42.tfm.exe
3296	Explorer.EXE
3296	Explorer.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3296	Explorer.EXE
3916	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 4348	248	miner.exe	78
PID 248 wrote to memory of 4348	248	miner.exe	78
PID 4348 wrote to memory of 1872	4348	powershell.exe	80
PID 4348 wrote to memory of 1872	4348	powershell.exe	80
PID 4664 wrote to memory of 3792	4664	xmrig.exe	87
PID 4664 wrote to memory of 3792	4664	xmrig.exe	87
PID 3792 wrote to memory of 632	3792	4bqvfjv3.emx.exe	5
PID 3792 wrote to memory of 692	3792	4bqvfjv3.emx.exe	7
PID 3792 wrote to memory of 984	3792	4bqvfjv3.emx.exe	12
PID 3792 wrote to memory of 420	3792	4bqvfjv3.emx.exe	13
PID 3792 wrote to memory of 776	3792	4bqvfjv3.emx.exe	14
PID 3792 wrote to memory of 756	3792	4bqvfjv3.emx.exe	15
PID 3792 wrote to memory of 1052	3792	4bqvfjv3.emx.exe	16
PID 3792 wrote to memory of 1060	3792	4bqvfjv3.emx.exe	17
PID 3792 wrote to memory of 1140	3792	4bqvfjv3.emx.exe	18
PID 3792 wrote to memory of 1164	3792	4bqvfjv3.emx.exe	19
PID 3792 wrote to memory of 1248	3792	4bqvfjv3.emx.exe	21
PID 3792 wrote to memory of 1296	3792	4bqvfjv3.emx.exe	22
PID 3792 wrote to memory of 1408	3792	4bqvfjv3.emx.exe	23
PID 3792 wrote to memory of 1444	3792	4bqvfjv3.emx.exe	24
PID 3792 wrote to memory of 1508	3792	4bqvfjv3.emx.exe	25
PID 3792 wrote to memory of 1552	3792	4bqvfjv3.emx.exe	26
PID 3792 wrote to memory of 1564	3792	4bqvfjv3.emx.exe	27
PID 3792 wrote to memory of 1692	3792	4bqvfjv3.emx.exe	28
PID 3792 wrote to memory of 1712	3792	4bqvfjv3.emx.exe	29
PID 3792 wrote to memory of 1744	3792	4bqvfjv3.emx.exe	30
PID 3792 wrote to memory of 1824	3792	4bqvfjv3.emx.exe	31
PID 3792 wrote to memory of 1832	3792	4bqvfjv3.emx.exe	32
PID 3792 wrote to memory of 1896	3792	4bqvfjv3.emx.exe	33
PID 3792 wrote to memory of 1904	3792	4bqvfjv3.emx.exe	34
PID 3792 wrote to memory of 1996	3792	4bqvfjv3.emx.exe	35
PID 3792 wrote to memory of 1132	3792	4bqvfjv3.emx.exe	36
PID 3792 wrote to memory of 1888	3792	4bqvfjv3.emx.exe	37
PID 3792 wrote to memory of 2164	3792	4bqvfjv3.emx.exe	39
PID 3792 wrote to memory of 2424	3792	4bqvfjv3.emx.exe	40
PID 3792 wrote to memory of 2496	3792	4bqvfjv3.emx.exe	41
PID 3792 wrote to memory of 2508	3792	4bqvfjv3.emx.exe	42
PID 3792 wrote to memory of 2560	3792	4bqvfjv3.emx.exe	43
PID 3792 wrote to memory of 2652	3792	4bqvfjv3.emx.exe	44
PID 3792 wrote to memory of 2668	3792	4bqvfjv3.emx.exe	45
PID 3792 wrote to memory of 2676	3792	4bqvfjv3.emx.exe	46
PID 3792 wrote to memory of 2700	3792	4bqvfjv3.emx.exe	47
PID 3792 wrote to memory of 2712	3792	4bqvfjv3.emx.exe	48
PID 3792 wrote to memory of 3044	3792	4bqvfjv3.emx.exe	49
PID 3792 wrote to memory of 3064	3792	4bqvfjv3.emx.exe	50
PID 3792 wrote to memory of 3076	3792	4bqvfjv3.emx.exe	51
PID 3792 wrote to memory of 3296	3792	4bqvfjv3.emx.exe	52
PID 3792 wrote to memory of 3424	3792	4bqvfjv3.emx.exe	53
PID 3792 wrote to memory of 3488	3792	4bqvfjv3.emx.exe	54
PID 3792 wrote to memory of 3852	3792	4bqvfjv3.emx.exe	57
PID 3792 wrote to memory of 3916	3792	4bqvfjv3.emx.exe	58
PID 3792 wrote to memory of 3956	3792	4bqvfjv3.emx.exe	59
PID 3792 wrote to memory of 4024	3792	4bqvfjv3.emx.exe	60
PID 3792 wrote to memory of 4204	3792	4bqvfjv3.emx.exe	61
PID 3792 wrote to memory of 4444	3792	4bqvfjv3.emx.exe	62
PID 3792 wrote to memory of 3864	3792	4bqvfjv3.emx.exe	65
PID 3792 wrote to memory of 2784	3792	4bqvfjv3.emx.exe	66
PID 3792 wrote to memory of 464	3792	4bqvfjv3.emx.exe	67
PID 3792 wrote to memory of 4832	3792	4bqvfjv3.emx.exe	68
PID 3792 wrote to memory of 4180	3792	4bqvfjv3.emx.exe	70
PID 3792 wrote to memory of 1764	3792	4bqvfjv3.emx.exe	71
PID 3792 wrote to memory of 4284	3792	4bqvfjv3.emx.exe	72
PID 3792 wrote to memory of 2664	3792	4bqvfjv3.emx.exe	74
PID 4664 wrote to memory of 5032	4664	xmrig.exe	88

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:420

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1508
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1132

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:2560

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3064

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3076

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:3296
- C:\Users\Admin\AppData\Local\Temp\miner.exe
  "C:\Users\Admin\AppData\Local\Temp\miner.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Roaming\xmrig.zip' -DestinationPath 'C:\Users\Admin\AppData\Roaming\xmrig' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Expand-Archive -Path C:\Users\Admin\AppData\Roaming\xmrig.zip -DestinationPath C:\Users\Admin\AppData\Roaming\xmrig -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1872
- C:\Users\Admin\AppData\Roaming\xmrig\xmrig\xmrig.exe
  "C:\Users\Admin\AppData\Roaming\xmrig\xmrig\xmrig.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\4bqvfjv3.emx.exe
    "C:\Users\Admin\AppData\Local\Temp\4bqvfjv3.emx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\fftj1v42.tfm.exe
    "C:\Users\Admin\AppData\Local\Temp\fftj1v42.tfm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3916

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4024

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4832

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4180

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4284

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops file in System32 directory
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ae626d9a72417b14570daa8fcd5d34a4

SHA1
c103ebaf4d760df722d620df87e6f07c0486439f

SHA256
52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

SHA512
a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\4bqvfjv3.emx.exe

Filesize
161KB

MD5
94f1ab3a068f83b32639579ec9c5d025

SHA1
38f3d5bc5de46feb8de093d11329766b8e2054ae

SHA256
879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0

SHA512
44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pnqbd2z4.5ec.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fftj1v42.tfm.exe

Filesize
9.1MB

MD5
cb166d49ce846727ed70134b589b0142

SHA1
8f5e1c7792e9580f2b10d7bef6dc7e63ea044688

SHA256
49da580656e51214d59702a1d983eff143af3560a344f524fe86326c53fb5ddb

SHA512
a39bd86a148af26fd31a0d171078fb7bce0951bb8ea63658d87f6bde97dbc214c62e8bd7152d1e621051de8a0ba77ffd7bda7c1106afb740584c80e68e1912ed

Download Submit
C:\Users\Admin\AppData\Roaming\xmrig.zip

Filesize
3.8MB

MD5
b05ea1c16d02ba5138ba00aeae714808

SHA1
694c0d229fdc5ae45e58f6023fa41dbbca4576e3

SHA256
89596216cb98e6923bcd7bc9f1ff69b04fc4bb12c5dae50c0ed531b9bd1d9a3c

SHA512
94501d26032949dfc1b868847ae2faa7aa89dbbd120449c296786ea65e4648125cb94831165402d52c6d245a2207f6613143fc6fdf51189ec624535cae049e62

Download Submit
C:\Users\Admin\AppData\Roaming\xmrig\xmrig\xmrig.exe

Filesize
9.3MB

MD5
72107c3009343491bdbd5a2bf27e0d17

SHA1
79ae9dd4ffc65810342c093fb3dd1413a830660d

SHA256
9af0d7469bffba8aea58c666b94ae68e34373f554ba8a145ec5fcc78baf0e6c6

SHA512
eab28e887aeb275527f4d4fa9a7ccd69dfaf21d249005eb9c9a9c098ca062cfabed02da2133e84c0b6109fbd4b6358e905199c24cdc9bb41799e63ccfbe3768e

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
436abb43e1164eb9c057d93909b5594f

SHA1
b2a32e83e314042c2dab164d4e006222cafc2b65

SHA256
7e7e48c02ae9d2f249170e38a8daf0e3c9e1feafb4c1a460b78814b7084735cf

SHA512
3206140fab3ca20665c647a328f8c4bf1c9df6a0bd4636b288ab8684dfc6d466eee06c16ebb33aad752d6ef1ccca7df3539282c1b9fdfebf0825eaa758baf8b8

Download Submit
memory/420-92-0x00000214DB640000-0x00000214DB66B000-memory.dmp

Filesize
172KB

Download
memory/420-93-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/632-83-0x000002BF4DA80000-0x000002BF4DAAB000-memory.dmp

Filesize
172KB

Download
memory/632-82-0x000002BF4DA50000-0x000002BF4DA75000-memory.dmp

Filesize
148KB

Download
memory/632-84-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/692-87-0x000001E92A9C0000-0x000001E92A9EB000-memory.dmp

Filesize
172KB

Download
memory/692-88-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/756-105-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/756-104-0x00000159BD0A0000-0x00000159BD0CB000-memory.dmp

Filesize
172KB

Download
memory/776-100-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/776-99-0x0000013FE01D0000-0x0000013FE01FB000-memory.dmp

Filesize
172KB

Download
memory/984-95-0x0000022C2A5D0000-0x0000022C2A5FB000-memory.dmp

Filesize
172KB

Download
memory/984-96-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1052-108-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1052-107-0x000002D242770000-0x000002D24279B000-memory.dmp

Filesize
172KB

Download
memory/1060-114-0x000001D29C370000-0x000001D29C39B000-memory.dmp

Filesize
172KB

Download
memory/1060-115-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1140-117-0x0000028E448B0000-0x0000028E448DB000-memory.dmp

Filesize
172KB

Download
memory/1140-118-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1164-120-0x0000021094D60000-0x0000021094D8B000-memory.dmp

Filesize
172KB

Download
memory/1164-121-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1248-124-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1248-123-0x000002C8AF740000-0x000002C8AF76B000-memory.dmp

Filesize
172KB

Download
memory/1296-128-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1296-127-0x000001EA6DB00000-0x000001EA6DB2B000-memory.dmp

Filesize
172KB

Download
memory/1408-137-0x000002081C2D0000-0x000002081C2FB000-memory.dmp

Filesize
172KB

Download
memory/1408-138-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1444-140-0x000001E6D3F90000-0x000001E6D3FBB000-memory.dmp

Filesize
172KB

Download
memory/1444-141-0x00007FF7C4610000-0x00007FF7C4620000-memory.dmp

Filesize
64KB

Download
memory/1508-143-0x000001661AAE0000-0x000001661AB0B000-memory.dmp

Filesize
172KB

Download
memory/1872-39-0x00000281E9E90000-0x00000281E9EA2000-memory.dmp

Filesize
72KB

Download
memory/1872-40-0x00000281E9D30000-0x00000281E9D3A000-memory.dmp

Filesize
40KB

Download
memory/3792-81-0x00007FF8037B0000-0x00007FF80386D000-memory.dmp

Filesize
756KB

Download
memory/3792-80-0x00007FF804580000-0x00007FF804789000-memory.dmp

Filesize
2.0MB

Download
memory/4348-67-0x00007FFFE3720000-0x00007FFFE41E2000-memory.dmp

Filesize
10.8MB

Download
memory/4348-18-0x00007FFFE3723000-0x00007FFFE3725000-memory.dmp

Filesize
8KB

Download
memory/4348-30-0x00007FFFE3720000-0x00007FFFE41E2000-memory.dmp

Filesize
10.8MB

Download
memory/4348-29-0x00007FFFE3720000-0x00007FFFE41E2000-memory.dmp

Filesize
10.8MB

Download
memory/4348-28-0x00007FFFE3720000-0x00007FFFE41E2000-memory.dmp

Filesize
10.8MB

Download
memory/4348-27-0x00000249C78C0000-0x00000249C78E2000-memory.dmp

Filesize
136KB

Download
memory/4664-70-0x0000011F2E1C0000-0x0000011F2EB06000-memory.dmp

Filesize
9.3MB

Download
memory/4664-226-0x0000011F49490000-0x0000011F4A0C4000-memory.dmp

Filesize
12.2MB

Download
memory/4664-71-0x0000011F2EF10000-0x0000011F2EF3C000-memory.dmp

Filesize
176KB

Download
memory/4664-338-0x0000011F49340000-0x0000011F4934E000-memory.dmp

Filesize
56KB

Download