#ParsedReport #CompletenessLow
18-09-2026

From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain

https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/

Report completeness: Low

Threats:
Xmrig_miner

Victims:
Cryptocurrency mining

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1012, T1027, T1027.009, T1053.005, T1059.001, T1070.003, T1071.001, T1071.004, T1105, T1140, have more...

IOCs:
Command: 2
Url: 7
File: 3
IP: 1
Hash: 6
Domain: 0
Email: 0
BrowserExtension: 0

Soft:
Microsoft Defender

Algorithms:
randomx, zip

Functions:
Set-PSReadLineOption

Win Services:
bits

Languages:
powershell