Analysis
-
max time kernel
1800s -
max time network
1596s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
29/03/2024, 02:05
Static task
static1
Behavioral task
behavioral1
Sample
miner100.exe
Resource
win10-20240221-en
General
-
Target
miner100.exe
-
Size
2.7MB
-
MD5
eae2347aaed97da4f802c0b32689f4eb
-
SHA1
a7a83d1ff7ec22d74d8415b95b3d57f1323699ce
-
SHA256
3d403e5661dd33a3e3e33585ce28384fde2f9d0d3e128ad5b46da1bec36ba0f4
-
SHA512
65f3411a7e80ec6d1dfea40d644ca621f4de929d17e58a54e43030b58662fedba11f000928049b4d3d7ae6ec38003d62dd8109c330ceba588be96f598b35d7cd
-
SSDEEP
49152:+Ev7yMxM0ZzUjqhWBkZFOj3nscD6gLRZdjM0PcuzQ3zAlkVKd:+EvWMxHUjqPPOjXsngLjdjBPz+3
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 4840 tiucgvijebnv.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe miner100.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5060 set thread context of 4688 5060 miner100.exe 95 -
Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 868 sc.exe 2856 sc.exe 3392 sc.exe 924 sc.exe 984 sc.exe 60 sc.exe 4372 sc.exe 2344 sc.exe 2576 sc.exe -
Modifies data under HKEY_USERS 47 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 5060 miner100.exe 2588 powershell.exe 2588 powershell.exe 2588 powershell.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 4688 dialer.exe 4688 dialer.exe 5060 miner100.exe 5060 miner100.exe 5060 miner100.exe 4688 dialer.exe 4688 dialer.exe 4840 tiucgvijebnv.exe 604 powershell.exe 604 powershell.exe 604 powershell.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4640 Process not Found 2956 Process not Found 4620 Process not Found 1244 Process not Found 1496 Process not Found 1996 Process not Found 4136 Process not Found 2576 Process not Found 1732 Process not Found 2748 Process not Found 3200 Process not Found 1524 Process not Found 2072 Process not Found 2384 Process not Found 4804 Process not Found 4888 Process not Found 208 Process not Found 2180 Process not Found 4952 Process not Found 1612 Process not Found 400 Process not Found 4428 Process not Found 3124 Process not Found 532 Process not Found 4556 Process not Found 2252 Process not Found 4456 Process not Found 2440 Process not Found 3100 Process not Found 2248 Process not Found 4296 Process not Found 4708 Process not Found 2112 Process not Found 1784 Process not Found 4796 Process not Found 1884 Process not Found 2284 Process not Found 3068 Process not Found 4812 Process not Found 1956 Process not Found 2436 Process not Found 2468 Process not Found 376 Process not Found 2888 Process not Found 1804 Process not Found 4340 Process not Found 4132 Process not Found 2904 Process not Found 4944 Process not Found 1676 Process not Found 4684 Process not Found 1092 Process not Found 2584 Process not Found 1964 Process not Found 4300 Process not Found 2412 Process not Found 3676 Process not Found 2916 Process not Found 4956 Process not Found 3648 Process not Found 1252 Process not Found 2720 Process not Found 2104 Process not Found 520 Process not Found -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2588 powershell.exe Token: SeIncreaseQuotaPrivilege 2588 powershell.exe Token: SeSecurityPrivilege 2588 powershell.exe Token: SeTakeOwnershipPrivilege 2588 powershell.exe Token: SeLoadDriverPrivilege 2588 powershell.exe Token: SeSystemProfilePrivilege 2588 powershell.exe Token: SeSystemtimePrivilege 2588 powershell.exe Token: SeProfSingleProcessPrivilege 2588 powershell.exe Token: SeIncBasePriorityPrivilege 2588 powershell.exe Token: SeCreatePagefilePrivilege 2588 powershell.exe Token: SeBackupPrivilege 2588 powershell.exe Token: SeRestorePrivilege 2588 powershell.exe Token: SeShutdownPrivilege 2588 powershell.exe Token: SeDebugPrivilege 2588 powershell.exe Token: SeSystemEnvironmentPrivilege 2588 powershell.exe Token: SeRemoteShutdownPrivilege 2588 powershell.exe Token: SeUndockPrivilege 2588 powershell.exe Token: SeManageVolumePrivilege 2588 powershell.exe Token: 33 2588 powershell.exe Token: 34 2588 powershell.exe Token: 35 2588 powershell.exe Token: 36 2588 powershell.exe Token: SeShutdownPrivilege 2348 powercfg.exe Token: SeCreatePagefilePrivilege 2348 powercfg.exe Token: SeDebugPrivilege 5060 miner100.exe Token: SeShutdownPrivilege 2248 powercfg.exe Token: SeCreatePagefilePrivilege 2248 powercfg.exe Token: SeShutdownPrivilege 4320 powercfg.exe Token: SeCreatePagefilePrivilege 4320 powercfg.exe Token: SeShutdownPrivilege 2284 powercfg.exe Token: SeCreatePagefilePrivilege 2284 powercfg.exe Token: SeDebugPrivilege 4688 dialer.exe Token: SeDebugPrivilege 604 powershell.exe Token: SeAssignPrimaryTokenPrivilege 604 powershell.exe Token: SeIncreaseQuotaPrivilege 604 powershell.exe Token: SeSecurityPrivilege 604 powershell.exe Token: SeTakeOwnershipPrivilege 604 powershell.exe Token: SeLoadDriverPrivilege 604 powershell.exe Token: SeSystemtimePrivilege 604 powershell.exe Token: SeBackupPrivilege 604 powershell.exe Token: SeRestorePrivilege 604 powershell.exe Token: SeShutdownPrivilege 604 powershell.exe Token: SeSystemEnvironmentPrivilege 604 powershell.exe Token: SeUndockPrivilege 604 powershell.exe Token: SeManageVolumePrivilege 604 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3864 wrote to memory of 1680 3864 cmd.exe 81 PID 3864 wrote to memory of 1680 3864 cmd.exe 81 PID 5060 wrote to memory of 4688 5060 miner100.exe 95 PID 5060 wrote to memory of 4688 5060 miner100.exe 95 PID 5060 wrote to memory of 4688 5060 miner100.exe 95 PID 5060 wrote to memory of 4688 5060 miner100.exe 95 PID 5060 wrote to memory of 4688 5060 miner100.exe 95 PID 5060 wrote to memory of 4688 5060 miner100.exe 95 PID 5060 wrote to memory of 4688 5060 miner100.exe 95 PID 4688 wrote to memory of 592 4688 dialer.exe 5 PID 4688 wrote to memory of 644 4688 dialer.exe 7 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 4688 wrote to memory of 752 4688 dialer.exe 10 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 4688 wrote to memory of 908 4688 dialer.exe 13 PID 4688 wrote to memory of 1004 4688 dialer.exe 14 PID 4688 wrote to memory of 1020 4688 dialer.exe 15 PID 4688 wrote to memory of 588 4688 dialer.exe 16 PID 4688 wrote to memory of 1048 4688 dialer.exe 17 PID 4688 wrote to memory of 1056 4688 dialer.exe 18 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 4688 wrote to memory of 1064 4688 dialer.exe 19 PID 4688 wrote to memory of 1160 4688 dialer.exe 21 PID 4688 wrote to memory of 1236 4688 dialer.exe 22 PID 4688 wrote to memory of 1284 4688 dialer.exe 23 PID 4688 wrote to memory of 1344 4688 dialer.exe 24 PID 4688 wrote to memory of 1368 4688 dialer.exe 25 PID 4688 wrote to memory of 1436 4688 dialer.exe 26 PID 4688 wrote to memory of 1444 4688 dialer.exe 27 PID 4688 wrote to memory of 1552 4688 dialer.exe 28 PID 4688 wrote to memory of 1568 4688 dialer.exe 29 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 1444 wrote to memory of 5012 1444 svchost.exe 111 PID 1444 wrote to memory of 5012 1444 svchost.exe 111 PID 1444 wrote to memory of 4800 1444 svchost.exe 112 PID 1444 wrote to memory of 4800 1444 svchost.exe 112 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 1444 wrote to memory of 3040 1444 svchost.exe 114 PID 1444 wrote to memory of 3040 1444 svchost.exe 114 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44 PID 644 wrote to memory of 2488 644 lsass.exe 44
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:592
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:1004
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:644
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵PID:752
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵PID:908
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:1020
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵PID:588
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵PID:1048
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵
- Drops file in System32 directory
PID:1056
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵PID:1064
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵PID:1160
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1236
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵PID:1284
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1344
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵PID:1368
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵PID:1436
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\windows\system32\sihost.exesihost.exe2⤵PID:5012
-
-
\??\c:\windows\system32\sihost.exesihost.exe2⤵PID:4800
-
-
\??\c:\windows\system32\sihost.exesihost.exe2⤵PID:3040
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1552
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵PID:1568
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\miner100.exe"C:\Users\Admin\AppData\Local\Temp\miner100.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1680
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:924
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2576
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:984
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2856
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OPAGMGUY"2⤵
- Launches sc.exe
PID:60
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OPAGMGUY" binpath= "C:\ProgramData\axadwxtjeetz\tiucgvijebnv.exe" start= "auto"2⤵
- Launches sc.exe
PID:4372
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2344
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OPAGMGUY"2⤵
- Launches sc.exe
PID:3392
-
-
C:\ProgramData\axadwxtjeetz\tiucgvijebnv.exeC:\ProgramData\axadwxtjeetz\tiucgvijebnv.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4840 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5eae2347aaed97da4f802c0b32689f4eb
SHA1a7a83d1ff7ec22d74d8415b95b3d57f1323699ce
SHA2563d403e5661dd33a3e3e33585ce28384fde2f9d0d3e128ad5b46da1bec36ba0f4
SHA51265f3411a7e80ec6d1dfea40d644ca621f4de929d17e58a54e43030b58662fedba11f000928049b4d3d7ae6ec38003d62dd8109c330ceba588be96f598b35d7cd
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a