Analysis
- max time kernel
452s - max time network
896s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 15:00
General
- Target tungtung.ps1
- Size 1KB
- Sample260724-sdapbsfr51
- SHA256 0bd76089e9a297d1e6d323f2ac43788ac57898fcbbd18548d097830b629185ac
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of FindShellTrayWindow 10 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\tungtung.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\xmrig\xmrig-6.26.0\xmrig.exe"C:\Users\Admin\Desktop\xmrig\xmrig-6.26.0\xmrig.exe" -a rx/0 -o pool.hashvault.pro:443 -u 8AdDAwd7vZpPJvn5gVULXFBAvQeudVchgJGdH47pWaBvPjRmafuToc7Ghsoh6qAVJShUEjEz5GqLQcbjgWswsK7VTKMkefV -p tung-tung --cpu-priority 5 -t 2 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14 --donate-level 12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
__PSScriptPolicyTest_ik3u4dae.trq.ps1
xmrig.exe
memory/244-153-0x000001B374C20000-0x000001B374EBE000-memory.dmp
memory/2628-199-0x000001FB16BD0000-0x000001FB16E6E000-memory.dmp
memory/2628-131-0x000001FB153E0000-0x000001FB15400000-memory.dmp
memory/2628-104-0x000001FB03F80000-0x000001FB03FA0000-memory.dmp
memory/2628-88-0x000001FB15000000-0x000001FB15100000-memory.dmp
memory/2628-87-0x000001FB03D00000-0x000001FB03D20000-memory.dmp
memory/4836-15-0x00000254766A0000-0x0000025476752000-memory.dmp
memory/4836-10-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-14-0x00000254763B0000-0x00000254763CE000-memory.dmp
memory/4836-23-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-24-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-26-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-22-0x0000025476430000-0x0000025476454000-memory.dmp
memory/4836-29-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-30-0x0000025476420000-0x0000025476432000-memory.dmp
memory/4836-31-0x0000025476410000-0x000002547641A000-memory.dmp
memory/4836-18-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-1-0x000002545DDC0000-0x000002545DDE2000-memory.dmp
memory/4836-2-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-5-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-6-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-63-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-65-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-7-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-8-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-20-0x00000254763D0000-0x00000254763DA000-memory.dmp
memory/4836-19-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-0-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp
memory/4836-17-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-16-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-11-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-21-0x0000025476430000-0x000002547645A000-memory.dmp
memory/4836-9-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4956-66-0x0000020C61C70000-0x0000020C61C90000-memory.dmp
memory/4956-67-0x0000020C61CA0000-0x0000020C61CC0000-memory.dmp
memory/4956-62-0x0000020C61CA0000-0x0000020C61CC0000-memory.dmp
memory/4956-61-0x0000020C61C70000-0x0000020C61C90000-memory.dmp
memory/4956-60-0x0000020C61C50000-0x0000020C61C70000-memory.dmp
memory/4956-59-0x0000020C61C10000-0x0000020C61C30000-memory.dmp