{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 10, "direct_entities": 20, "direct_relationships": 10, "invalid_iocs": 0, "iocs": 10, "mentioned": 0, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 0, "excluded_graph_objects": 209, "graph_complete": true, "graph_objects": 20, "graph_relationships": 10, "mitre_context_complete": true, "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "status_as_of": "2026-10-10T20:16:31+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.004Z", "created_at": "2026-09-26T18:28:12.787Z", "modified": "2026-09-26T18:28:16.163Z", "updated_at": "2026-09-26T18:28:16.163Z" }, "description_available": false, "entity_type": "Indicator", "id": "1739bb75-5db2-44c5-a5ad-63840188b090", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--23b10b2f-7cd0-54e1-a314-df91839da3af", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:10.715Z", "updated_at": "2026-09-26T18:28:11.234Z" }, "description_available": false, "entity_type": "StixFile", "id": "26d2f669-0cae-4f5a-ba24-275e87290fec", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--08727bbf-0b70-5dbd-b718-a65b97957891", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.001Z", "created_at": "2026-09-26T18:28:12.782Z", "modified": "2026-09-26T18:28:17.892Z", "updated_at": "2026-09-26T18:28:17.892Z" }, "description_available": false, "entity_type": "Indicator", "id": "27c4d95e-453a-417f-87aa-a596810cabbd", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--2304f895-183e-5159-8462-065d3bdb56f0", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.008Z", "created_at": "2026-09-26T18:28:14.636Z", "modified": "2026-09-26T18:28:23.854Z", "updated_at": "2026-09-26T18:28:23.854Z" }, "description_available": false, "entity_type": "Indicator", "id": "2d4c7757-0766-426d-9569-4c27b5f6d09b", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--8c44a67e-425a-5326-ae62-f060824d241d", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:11.417Z", "updated_at": "2026-09-26T18:28:11.890Z" }, "description_available": false, "entity_type": "StixFile", "id": "2dc70f36-c800-463b-b46c-81974539e251", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--38e5648f-d89f-52cc-915c-5dacde68e151", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.017Z", "created_at": "2026-09-26T18:28:16.634Z", "modified": "2026-09-26T18:28:30.098Z", "updated_at": "2026-09-26T18:28:30.098Z" }, "description_available": false, "entity_type": "Indicator", "id": "2fd9cea6-51ba-4959-b319-a404453aaf81", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--9e632253-9c5e-5276-84d9-3ebdea3eb455", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:08.267Z", "updated_at": "2026-09-26T18:28:08.578Z" }, "description_available": false, "entity_type": "StixFile", "id": "430d7576-389e-4734-b1a2-79352105f8b1", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--caa91c00-e8dd-5df4-bdd1-a8a12cd2f7e3", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:08.242Z", "updated_at": "2026-09-26T18:28:08.430Z" }, "description_available": false, "entity_type": "StixFile", "id": "437f50cc-3a12-4069-b1fa-896ab63cacc6", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--6a59445c-bd0a-5c2f-aeac-4079f2abd443", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.028Z", "created_at": "2026-09-26T18:28:23.749Z", "modified": "2026-09-26T18:28:42.961Z", "updated_at": "2026-09-26T18:28:42.961Z" }, "description_available": false, "entity_type": "Indicator", "id": "51d002be-999c-40b1-a2c3-4f9f77442a10", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--8238df16-3439-57a7-8555-5dfd36091899", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:09.647Z", "updated_at": "2026-09-26T18:28:10.139Z" }, "description_available": false, "entity_type": "StixFile", "id": "533e2f82-280e-4887-b7f8-8c6cf4bc90a4", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--85bd6045-d333-5658-907c-3923f631902b", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:09.430Z", "updated_at": "2026-09-26T18:28:09.824Z" }, "description_available": false, "entity_type": "StixFile", "id": "5ff7675b-49cc-4842-80e5-e23ae7efa61b", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--25e2d098-6b4a-5e66-8d12-2fe002ec14ca", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:12.641Z", "updated_at": "2026-09-26T18:28:13.568Z" }, "description_available": false, "entity_type": "StixFile", "id": "6542dd19-62e4-4152-8851-d4cd8a07665e", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--f374c9d1-e883-5a04-90bc-c445da016644", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.026Z", "created_at": "2026-09-26T18:28:18.444Z", "modified": "2026-09-26T18:28:35.971Z", "updated_at": "2026-09-26T18:28:35.971Z" }, "description_available": false, "entity_type": "Indicator", "id": "73f0a131-496e-4ef3-91fd-09e313b8ff34", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--464978db-3648-52a0-acfb-d506b8be5d70", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:08.588Z", "updated_at": "2026-09-26T18:28:09.010Z" }, "description_available": false, "entity_type": "StixFile", "id": "7480e7e6-5a5b-4286-bc6e-84d304d84c31", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--ecb43788-29e6-50b2-b816-17fe4cca65d6", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.011Z", "created_at": "2026-09-26T18:28:15.207Z", "modified": "2026-09-26T18:28:27.662Z", "updated_at": "2026-09-26T18:28:27.662Z" }, "description_available": false, "entity_type": "Indicator", "id": "8211eb2b-3533-4726-8e3e-130898803c57", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--662302a9-cf75-5c64-b128-a2623966c21d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.023Z", "created_at": "2026-09-26T18:28:17.771Z", "modified": "2026-09-26T18:28:41.056Z", "updated_at": "2026-09-26T18:28:41.056Z" }, "description_available": false, "entity_type": "Indicator", "id": "b0afa41d-2267-4786-aad8-f37f77a43504", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--18a243ec-31b7-5116-813e-dc46506dac92", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.014Z", "created_at": "2026-09-26T18:28:15.207Z", "modified": "2026-09-26T18:28:25.232Z", "updated_at": "2026-09-26T18:28:25.232Z" }, "description_available": false, "entity_type": "Indicator", "id": "b19c7485-d92f-42d3-be2d-63069e98aa71", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--66dc54cd-20b7-50d8-bce1-baad22317960", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.020Z", "created_at": "2026-09-26T18:28:17.762Z", "modified": "2026-09-26T18:28:33.991Z", "updated_at": "2026-09-26T18:28:33.991Z" }, "description_available": false, "entity_type": "Indicator", "id": "bed63d1f-493e-4e4f-89f2-c090a0d5b301", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "indicator--e4b2d1a1-2f4b-5104-a5f2-5c49e26915ec", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:10.977Z", "updated_at": "2026-09-26T18:28:11.635Z" }, "description_available": false, "entity_type": "StixFile", "id": "c08908f0-7b0e-4152-a511-a1df880e892a", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--5ed68619-86f4-5d65-ad2e-5572d643fc58", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T18:28:09.729Z", "updated_at": "2026-09-26T18:28:10.220Z" }, "description_available": false, "entity_type": "StixFile", "id": "c36902ec-a8b7-4bfb-af2d-884bb4de751a", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "file--19c5c0be-db1b-56ab-82bd-85365d01fc82", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.015Z", "created_at": "2026-09-26T18:28:26.289Z", "modified": "2026-09-26T18:28:26.743Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:26.743Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b19c7485-d92f-42d3-be2d-63069e98aa71", "from_id": "b19c7485-d92f-42d3-be2d-63069e98aa71", "from_name": null, "from_type": "Indicator", "id": "605c0770-d98e-4672-b3dd-952cc5c210e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--4ce28436-3594-5197-bd12-afcf2b6f154b", "toId": "533e2f82-280e-4887-b7f8-8c6cf4bc90a4", "to_id": "533e2f82-280e-4887-b7f8-8c6cf4bc90a4", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.021Z", "created_at": "2026-09-26T18:28:27.500Z", "modified": "2026-09-26T18:28:27.931Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:27.931Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bed63d1f-493e-4e4f-89f2-c090a0d5b301", "from_id": "bed63d1f-493e-4e4f-89f2-c090a0d5b301", "from_name": null, "from_type": "Indicator", "id": "6bb4af05-f7db-4d4a-bf98-e9b58e76f9c6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--c664fe92-aa2e-5e54-972a-40be0ca5ecf3", "toId": "26d2f669-0cae-4f5a-ba24-275e87290fec", "to_id": "26d2f669-0cae-4f5a-ba24-275e87290fec", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.027Z", "created_at": "2026-09-26T18:28:28.005Z", "modified": "2026-09-26T18:28:28.819Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:28.819Z" }, "description_available": false, "entity_type": "based-on", "fromId": "73f0a131-496e-4ef3-91fd-09e313b8ff34", "from_id": "73f0a131-496e-4ef3-91fd-09e313b8ff34", "from_name": null, "from_type": "Indicator", "id": "6c90b7d8-7876-4d02-beba-9e161cdd406e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--e27fcd54-d1b4-5664-8e99-1a8448b6d0aa", "toId": "2dc70f36-c800-463b-b46c-81974539e251", "to_id": "2dc70f36-c800-463b-b46c-81974539e251", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.003Z", "created_at": "2026-09-26T18:28:24.029Z", "modified": "2026-09-26T18:28:25.592Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:25.592Z" }, "description_available": false, "entity_type": "based-on", "fromId": "27c4d95e-453a-417f-87aa-a596810cabbd", "from_id": "27c4d95e-453a-417f-87aa-a596810cabbd", "from_name": null, "from_type": "Indicator", "id": "81e5c2ef-c25a-4af3-944a-9783225e9cae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--0d708d06-f41e-52d6-8d25-17300e6ba108", "toId": "437f50cc-3a12-4069-b1fa-896ab63cacc6", "to_id": "437f50cc-3a12-4069-b1fa-896ab63cacc6", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.018Z", "created_at": "2026-09-26T18:28:27.128Z", "modified": "2026-09-26T18:28:27.561Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:27.561Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2fd9cea6-51ba-4959-b319-a404453aaf81", "from_id": "2fd9cea6-51ba-4959-b319-a404453aaf81", "from_name": null, "from_type": "Indicator", "id": "86fae6bb-3b3d-46b3-93b1-91beedab1bd9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--6faaef71-7f39-5e4b-8cfd-0f45b8681433", "toId": "c36902ec-a8b7-4bfb-af2d-884bb4de751a", "to_id": "c36902ec-a8b7-4bfb-af2d-884bb4de751a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.013Z", "created_at": "2026-09-26T18:28:26.289Z", "modified": "2026-09-26T18:28:26.744Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:26.744Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8211eb2b-3533-4726-8e3e-130898803c57", "from_id": "8211eb2b-3533-4726-8e3e-130898803c57", "from_name": null, "from_type": "Indicator", "id": "8e396c32-3fd9-45e6-8c1c-be3ddef85ae1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--8f37ddf3-dc24-5596-8eb2-750a4460900a", "toId": "5ff7675b-49cc-4842-80e5-e23ae7efa61b", "to_id": "5ff7675b-49cc-4842-80e5-e23ae7efa61b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.006Z", "created_at": "2026-09-26T18:28:24.026Z", "modified": "2026-09-26T18:28:25.414Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:25.414Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1739bb75-5db2-44c5-a5ad-63840188b090", "from_id": "1739bb75-5db2-44c5-a5ad-63840188b090", "from_name": null, "from_type": "Indicator", "id": "926f43a7-8d5e-4762-9e43-e4f2881ab605", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--d96096fe-7701-5ccb-b7f1-a83e01b16033", "toId": "7480e7e6-5a5b-4286-bc6e-84d304d84c31", "to_id": "7480e7e6-5a5b-4286-bc6e-84d304d84c31", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.009Z", "created_at": "2026-09-26T18:28:25.977Z", "modified": "2026-09-26T18:28:26.461Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:26.461Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2d4c7757-0766-426d-9569-4c27b5f6d09b", "from_id": "2d4c7757-0766-426d-9569-4c27b5f6d09b", "from_name": null, "from_type": "Indicator", "id": "d15093c4-be19-4618-b48e-a8c3227c57d3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--18f8ea55-3a51-50a5-8eb5-c465b2c913c1", "toId": "430d7576-389e-4734-b1a2-79352105f8b1", "to_id": "430d7576-389e-4734-b1a2-79352105f8b1", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.024Z", "created_at": "2026-09-26T18:28:27.500Z", "modified": "2026-09-26T18:28:27.956Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:27.956Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b0afa41d-2267-4786-aad8-f37f77a43504", "from_id": "b0afa41d-2267-4786-aad8-f37f77a43504", "from_name": null, "from_type": "Indicator", "id": "db389541-6a19-4114-b70c-41597c5a77b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--c1444920-679f-5eee-881f-f5fe83270d56", "toId": "c08908f0-7b0e-4152-a511-a1df880e892a", "to_id": "c08908f0-7b0e-4152-a511-a1df880e892a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:58:47.030Z", "created_at": "2026-09-26T18:28:28.753Z", "modified": "2026-09-26T18:28:29.177Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T18:28:29.177Z" }, "description_available": false, "entity_type": "based-on", "fromId": "51d002be-999c-40b1-a2c3-4f9f77442a10", "from_id": "51d002be-999c-40b1-a2c3-4f9f77442a10", "from_name": null, "from_type": "Indicator", "id": "e66e2b19-982e-430f-942c-f725d7ab7673", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "standard_id": "relationship--2b8549e9-d72c-5af1-89d7-5a2999b2be7e", "toId": "6542dd19-62e4-4152-8851-d4cd8a07665e", "to_id": "6542dd19-62e4-4152-8851-d4cd8a07665e", "to_name": null, "to_type": "StixFile" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "94b50ace73cc03790678c73b867be129", "description_available": false, "object_id": "27c4d95e-453a-417f-87aa-a596810cabbd", "object_ids": [ "27c4d95e-453a-417f-87aa-a596810cabbd", "437f50cc-3a12-4069-b1fa-896ab63cacc6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "27c4d95e-453a-417f-87aa-a596810cabbd", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "94b50ace73cc03790678c73b867be129" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "437f50cc-3a12-4069-b1fa-896ab63cacc6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "94b50ace73cc03790678c73b867be129" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "md5", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "94b50ace73cc03790678c73b867be129" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "be860a15b7e5d44b0b3d67f598238fad", "description_available": false, "object_id": "1739bb75-5db2-44c5-a5ad-63840188b090", "object_ids": [ "1739bb75-5db2-44c5-a5ad-63840188b090", "7480e7e6-5a5b-4286-bc6e-84d304d84c31" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1739bb75-5db2-44c5-a5ad-63840188b090", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "be860a15b7e5d44b0b3d67f598238fad" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "7480e7e6-5a5b-4286-bc6e-84d304d84c31", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "be860a15b7e5d44b0b3d67f598238fad" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "md5", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "be860a15b7e5d44b0b3d67f598238fad" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "c024189e1e7fa0ae6d24353367e8b98d", "description_available": false, "object_id": "2d4c7757-0766-426d-9569-4c27b5f6d09b", "object_ids": [ "2d4c7757-0766-426d-9569-4c27b5f6d09b", "430d7576-389e-4734-b1a2-79352105f8b1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2d4c7757-0766-426d-9569-4c27b5f6d09b", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "c024189e1e7fa0ae6d24353367e8b98d" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "430d7576-389e-4734-b1a2-79352105f8b1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "c024189e1e7fa0ae6d24353367e8b98d" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "md5", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "c024189e1e7fa0ae6d24353367e8b98d" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ed276b2312f641b00f87fa18e85c48eb", "description_available": false, "object_id": "8211eb2b-3533-4726-8e3e-130898803c57", "object_ids": [ "5ff7675b-49cc-4842-80e5-e23ae7efa61b", "8211eb2b-3533-4726-8e3e-130898803c57" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8211eb2b-3533-4726-8e3e-130898803c57", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "ed276b2312f641b00f87fa18e85c48eb" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "5ff7675b-49cc-4842-80e5-e23ae7efa61b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ed276b2312f641b00f87fa18e85c48eb" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "md5", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "ed276b2312f641b00f87fa18e85c48eb" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f1d2fdb7f3b699da69a050c5352a33c2", "description_available": false, "object_id": "b19c7485-d92f-42d3-be2d-63069e98aa71", "object_ids": [ "533e2f82-280e-4887-b7f8-8c6cf4bc90a4", "b19c7485-d92f-42d3-be2d-63069e98aa71" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b19c7485-d92f-42d3-be2d-63069e98aa71", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "f1d2fdb7f3b699da69a050c5352a33c2" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "533e2f82-280e-4887-b7f8-8c6cf4bc90a4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f1d2fdb7f3b699da69a050c5352a33c2" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "md5", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "f1d2fdb7f3b699da69a050c5352a33c2" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "f94de28bd66afc4679f546500db184d4", "description_available": false, "object_id": "2fd9cea6-51ba-4959-b319-a404453aaf81", "object_ids": [ "2fd9cea6-51ba-4959-b319-a404453aaf81", "c36902ec-a8b7-4bfb-af2d-884bb4de751a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2fd9cea6-51ba-4959-b319-a404453aaf81", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "f94de28bd66afc4679f546500db184d4" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c36902ec-a8b7-4bfb-af2d-884bb4de751a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "f94de28bd66afc4679f546500db184d4" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "md5", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "f94de28bd66afc4679f546500db184d4" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "608c34e10713278fbe80b7cb5dedb0555cff1559", "description_available": false, "object_id": "bed63d1f-493e-4e4f-89f2-c090a0d5b301", "object_ids": [ "26d2f669-0cae-4f5a-ba24-275e87290fec", "bed63d1f-493e-4e4f-89f2-c090a0d5b301" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "bed63d1f-493e-4e4f-89f2-c090a0d5b301", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "608c34e10713278fbe80b7cb5dedb0555cff1559" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "26d2f669-0cae-4f5a-ba24-275e87290fec", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "608c34e10713278fbe80b7cb5dedb0555cff1559" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "sha1", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "608c34e10713278fbe80b7cb5dedb0555cff1559" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "d2a98fe01257d897a0dc5994392cbde9089fadf9", "description_available": false, "object_id": "b0afa41d-2267-4786-aad8-f37f77a43504", "object_ids": [ "b0afa41d-2267-4786-aad8-f37f77a43504", "c08908f0-7b0e-4152-a511-a1df880e892a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b0afa41d-2267-4786-aad8-f37f77a43504", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "d2a98fe01257d897a0dc5994392cbde9089fadf9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c08908f0-7b0e-4152-a511-a1df880e892a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "d2a98fe01257d897a0dc5994392cbde9089fadf9" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "sha1", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "d2a98fe01257d897a0dc5994392cbde9089fadf9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "39368a9465aca3286e4436650b7a33b39a9294a81f3e681e056c9da0550e27c4", "description_available": false, "object_id": "73f0a131-496e-4ef3-91fd-09e313b8ff34", "object_ids": [ "2dc70f36-c800-463b-b46c-81974539e251", "73f0a131-496e-4ef3-91fd-09e313b8ff34" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "73f0a131-496e-4ef3-91fd-09e313b8ff34", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "39368a9465aca3286e4436650b7a33b39a9294a81f3e681e056c9da0550e27c4" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "2dc70f36-c800-463b-b46c-81974539e251", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "39368a9465aca3286e4436650b7a33b39a9294a81f3e681e056c9da0550e27c4" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "sha256", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "39368a9465aca3286e4436650b7a33b39a9294a81f3e681e056c9da0550e27c4" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9839448acc050331b5713882a25b863b47993a0f2859b4820563e34c72f5b679", "description_available": false, "object_id": "51d002be-999c-40b1-a2c3-4f9f77442a10", "object_ids": [ "51d002be-999c-40b1-a2c3-4f9f77442a10", "6542dd19-62e4-4152-8851-d4cd8a07665e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "51d002be-999c-40b1-a2c3-4f9f77442a10", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "9839448acc050331b5713882a25b863b47993a0f2859b4820563e34c72f5b679" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "6542dd19-62e4-4152-8851-d4cd8a07665e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9839448acc050331b5713882a25b863b47993a0f2859b4820563e34c72f5b679" } ], "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/", "type": "sha256", "valid_from": "2026-09-21T15:16:14.000Z", "valid_until": "2027-07-09T02:25:58.557Z", "validity_status": "active", "value": "9839448acc050331b5713882a25b863b47993a0f2859b4820563e34c72f5b679" } ], "mentioned": [], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-21T15:16:13.321Z", "created_at": "2026-09-26T18:32:21.096Z", "modified": "2026-09-26T18:32:21.859Z", "published": "2026-09-21T15:16:13.321Z", "updated_at": "2026-09-26T18:32:21.859Z" }, "description_available": true, "id": "af708da3-d915-4e8b-8770-93b256ce653f", "is_inferred": false, "labels": [ "cryptocurrency mining", "dns txt records", "in-memory execution", "obfuscation", "powershell", "registry persistence", "steganography", "wav files" ], "lang": "en", "name": "From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-21T15:16:13.321Z", "references": [ { "external_id": null, "id": "bf2a0684-8cf0-481e-bbf5-f3ca3afe7804", "source_name": "alien-vault", "url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/" }, { "external_id": "6ab14a3d40e63bae6b1e58b3", "id": "cb964b47-4225-48e3-9479-7e3fdb4cc7d8", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6ab14a3d40e63bae6b1e58b3" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "af708da3-d915-4e8b-8770-93b256ce653f", "schema_version": 1, "selected_date": "2026-09-21", "source_url": "https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/" }