Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe
-
Size
5.3MB
-
MD5
7788601bd28ef98aa4a4a477a33e9cc0
-
SHA1
1dff5df64ed658249bcac6f999b295b7b3651ce3
-
SHA256
8deedc9bb91016728eb0e610e79fda04cdaa748bd9b6b67f09ec1d807ad75758
-
SHA512
63caa3ba22aaddf2688d88453f6c8fab59c28c8d504527f03618c5dffa7653ae1bb8097b9408fcac9a5f731d5a0a430ba7aa9beb400690a4163abdecd700e6c7
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
XMRig Miner payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/2912-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2912-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 3164 powershell.exe 212 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
fqwofdtexigy.exepid process 628 fqwofdtexigy.exe -
Processes:
resource yara_rule behavioral2/memory/2912-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2912-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exepowershell.exefqwofdtexigy.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fqwofdtexigy.exedescription pid process target process PID 628 set thread context of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 set thread context of 2912 628 fqwofdtexigy.exe nslookup.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2408 sc.exe 2840 sc.exe 3952 sc.exe 4068 sc.exe 320 sc.exe 4644 sc.exe 4408 sc.exe 4988 sc.exe 3632 sc.exe 4512 sc.exe 3748 sc.exe 112 sc.exe 1584 sc.exe 3768 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exepowershell.exefqwofdtexigy.exepowershell.exenslookup.exepid process 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 3164 powershell.exe 3164 powershell.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1760 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 628 fqwofdtexigy.exe 212 powershell.exe 212 powershell.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 628 fqwofdtexigy.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe 2912 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exenslookup.exedescription pid process Token: SeDebugPrivilege 3164 powershell.exe Token: SeShutdownPrivilege 2120 powercfg.exe Token: SeCreatePagefilePrivilege 2120 powercfg.exe Token: SeShutdownPrivilege 4460 powercfg.exe Token: SeCreatePagefilePrivilege 4460 powercfg.exe Token: SeShutdownPrivilege 1400 powercfg.exe Token: SeCreatePagefilePrivilege 1400 powercfg.exe Token: SeShutdownPrivilege 5044 powercfg.exe Token: SeCreatePagefilePrivilege 5044 powercfg.exe Token: SeDebugPrivilege 212 powershell.exe Token: SeShutdownPrivilege 4732 powercfg.exe Token: SeCreatePagefilePrivilege 4732 powercfg.exe Token: SeShutdownPrivilege 4080 powercfg.exe Token: SeCreatePagefilePrivilege 4080 powercfg.exe Token: SeShutdownPrivilege 1208 powercfg.exe Token: SeCreatePagefilePrivilege 1208 powercfg.exe Token: SeShutdownPrivilege 3748 powercfg.exe Token: SeCreatePagefilePrivilege 3748 powercfg.exe Token: SeLockMemoryPrivilege 2912 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.execmd.execmd.exefqwofdtexigy.exedescription pid process target process PID 4476 wrote to memory of 4544 4476 cmd.exe wusa.exe PID 4476 wrote to memory of 4544 4476 cmd.exe wusa.exe PID 3660 wrote to memory of 5096 3660 cmd.exe choice.exe PID 3660 wrote to memory of 5096 3660 cmd.exe choice.exe PID 3248 wrote to memory of 4932 3248 cmd.exe wusa.exe PID 3248 wrote to memory of 4932 3248 cmd.exe wusa.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 1152 628 fqwofdtexigy.exe conhost.exe PID 628 wrote to memory of 2912 628 fqwofdtexigy.exe nslookup.exe PID 628 wrote to memory of 2912 628 fqwofdtexigy.exe nslookup.exe PID 628 wrote to memory of 2912 628 fqwofdtexigy.exe nslookup.exe PID 628 wrote to memory of 2912 628 fqwofdtexigy.exe nslookup.exe PID 628 wrote to memory of 2912 628 fqwofdtexigy.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeFilesize
5.3MB
MD57788601bd28ef98aa4a4a477a33e9cc0
SHA11dff5df64ed658249bcac6f999b295b7b3651ce3
SHA2568deedc9bb91016728eb0e610e79fda04cdaa748bd9b6b67f09ec1d807ad75758
SHA51263caa3ba22aaddf2688d88453f6c8fab59c28c8d504527f03618c5dffa7653ae1bb8097b9408fcac9a5f731d5a0a430ba7aa9beb400690a4163abdecd700e6c7
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wlqxpaxr.3j0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/212-42-0x000001A67A730000-0x000001A67A73A000-memory.dmpFilesize
40KB
-
memory/212-41-0x000001A67A750000-0x000001A67A76C000-memory.dmpFilesize
112KB
-
memory/212-46-0x000001A67A780000-0x000001A67A78A000-memory.dmpFilesize
40KB
-
memory/212-45-0x000001A67A770000-0x000001A67A776000-memory.dmpFilesize
24KB
-
memory/212-44-0x000001A67A740000-0x000001A67A748000-memory.dmpFilesize
32KB
-
memory/212-43-0x000001A67A790000-0x000001A67A7AA000-memory.dmpFilesize
104KB
-
memory/212-38-0x000001A679510000-0x000001A67952C000-memory.dmpFilesize
112KB
-
memory/212-39-0x000001A67A530000-0x000001A67A5E5000-memory.dmpFilesize
724KB
-
memory/212-40-0x000001A679500000-0x000001A67950A000-memory.dmpFilesize
40KB
-
memory/1152-52-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/1152-53-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/1152-56-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/1152-49-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/1152-51-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/1152-50-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2912-57-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-61-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-58-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-73-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-59-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-74-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-72-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-70-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-69-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-64-0x000001D53C350000-0x000001D53C370000-memory.dmpFilesize
128KB
-
memory/2912-63-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-66-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-68-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-67-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-65-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-62-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2912-60-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3164-16-0x00007FFE0EAF0000-0x00007FFE0F5B1000-memory.dmpFilesize
10.8MB
-
memory/3164-6-0x000002012B680000-0x000002012B6A2000-memory.dmpFilesize
136KB
-
memory/3164-11-0x00007FFE0EAF0000-0x00007FFE0F5B1000-memory.dmpFilesize
10.8MB
-
memory/3164-12-0x00007FFE0EAF0000-0x00007FFE0F5B1000-memory.dmpFilesize
10.8MB
-
memory/3164-13-0x00007FFE0EAF0000-0x00007FFE0F5B1000-memory.dmpFilesize
10.8MB
-
memory/3164-0-0x00007FFE0EAF3000-0x00007FFE0EAF5000-memory.dmpFilesize
8KB