Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-05-2024 18:17
Behavioral task
behavioral1
Sample
miner (2).TMP/Client.exe
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
miner (2).TMP/num2.exe
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
miner.TMP/MicrosoftEdgeUpdater.exe
Resource
win11-20240426-en
General
-
Target
miner (2).TMP/num2.exe
-
Size
4.3MB
-
MD5
e6fe75c4390d3970545f0fdbb3274244
-
SHA1
8b6ed33f1778800cf0549bd7214249bdb81fbb58
-
SHA256
48aaa21d99bf5fb15abc6945911438e5f3ac4c378ac89bc4eb850200f9f648d5
-
SHA512
17b0911f13a1348e6511faf412f63721e7df7b196ae3a6acb86789eb04a2f8a90a42a6931a0c0ad45ee98910c4661c6db7e43623c560a963cd4d021ce9b1ad20
-
SSDEEP
98304:964joDvotqdFGNQPhzexAgEC3ziTnaK9vHQR1kUe3HB1ih:9RvtwFmQZ6xXECDAnaSswBM
Malware Config
Signatures
-
XMRig Miner payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4512-27-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4512-30-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4512-29-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4512-31-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4512-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4512-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4512-26-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 4980 powershell.exe 632 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 4 IoCs
Processes:
jhi_service.exeMicrosoftEdgeUpdater.exekanilzbpgdul.exefdjrmaypnxal.exepid process 4676 jhi_service.exe 4748 MicrosoftEdgeUpdater.exe 2536 kanilzbpgdul.exe 4280 fdjrmaypnxal.exe -
Processes:
resource yara_rule behavioral2/memory/4512-21-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-24-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-25-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-23-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-26-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4512-22-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
num2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" num2.exe -
Drops file in System32 directory 4 IoCs
Processes:
MicrosoftEdgeUpdater.exepowershell.exefdjrmaypnxal.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe MicrosoftEdgeUpdater.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fdjrmaypnxal.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
kanilzbpgdul.exeMicrosoftEdgeUpdater.exefdjrmaypnxal.exedescription pid process target process PID 2536 set thread context of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 set thread context of 4512 2536 kanilzbpgdul.exe svchost.exe PID 4748 set thread context of 972 4748 MicrosoftEdgeUpdater.exe dialer.exe PID 4280 set thread context of 5080 4280 fdjrmaypnxal.exe dialer.exe PID 4280 set thread context of 2008 4280 fdjrmaypnxal.exe dialer.exe PID 4280 set thread context of 344 4280 fdjrmaypnxal.exe dialer.exe -
Launches sc.exe 18 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2872 sc.exe 4264 sc.exe 4112 sc.exe 4964 sc.exe 2624 sc.exe 3760 sc.exe 2392 sc.exe 4684 sc.exe 1044 sc.exe 4772 sc.exe 1344 sc.exe 736 sc.exe 344 sc.exe 804 sc.exe 4012 sc.exe 4260 sc.exe 440 sc.exe 2900 sc.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe -
Modifies data under HKEY_USERS 57 IoCs
Processes:
powershell.exeOfficeClickToRun.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
jhi_service.exekanilzbpgdul.exeMicrosoftEdgeUpdater.exepowershell.exesvchost.exedialer.exefdjrmaypnxal.exepowershell.exepid process 4676 jhi_service.exe 4676 jhi_service.exe 4676 jhi_service.exe 4676 jhi_service.exe 4676 jhi_service.exe 4676 jhi_service.exe 4676 jhi_service.exe 4676 jhi_service.exe 2536 kanilzbpgdul.exe 2536 kanilzbpgdul.exe 2536 kanilzbpgdul.exe 2536 kanilzbpgdul.exe 2536 kanilzbpgdul.exe 2536 kanilzbpgdul.exe 4748 MicrosoftEdgeUpdater.exe 632 powershell.exe 632 powershell.exe 4512 svchost.exe 4512 svchost.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 972 dialer.exe 972 dialer.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4748 MicrosoftEdgeUpdater.exe 4280 fdjrmaypnxal.exe 972 dialer.exe 972 dialer.exe 4980 powershell.exe 4512 svchost.exe 4512 svchost.exe 4980 powershell.exe 4980 powershell.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe 4980 powershell.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe 4980 powershell.exe 972 dialer.exe 972 dialer.exe 4980 powershell.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe 972 dialer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exepowershell.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedialer.exesvchost.exedescription pid process Token: SeShutdownPrivilege 2268 powercfg.exe Token: SeCreatePagefilePrivilege 2268 powercfg.exe Token: SeShutdownPrivilege 3756 powercfg.exe Token: SeCreatePagefilePrivilege 3756 powercfg.exe Token: SeShutdownPrivilege 4612 powercfg.exe Token: SeCreatePagefilePrivilege 4612 powercfg.exe Token: SeShutdownPrivilege 3032 powercfg.exe Token: SeCreatePagefilePrivilege 3032 powercfg.exe Token: SeShutdownPrivilege 4968 powercfg.exe Token: SeCreatePagefilePrivilege 4968 powercfg.exe Token: SeShutdownPrivilege 2376 powercfg.exe Token: SeCreatePagefilePrivilege 2376 powercfg.exe Token: SeShutdownPrivilege 4940 powercfg.exe Token: SeCreatePagefilePrivilege 4940 powercfg.exe Token: SeShutdownPrivilege 5108 powercfg.exe Token: SeCreatePagefilePrivilege 5108 powercfg.exe Token: SeLockMemoryPrivilege 4512 svchost.exe Token: SeDebugPrivilege 632 powershell.exe Token: SeDebugPrivilege 972 dialer.exe Token: SeShutdownPrivilege 3332 powercfg.exe Token: SeCreatePagefilePrivilege 3332 powercfg.exe Token: SeShutdownPrivilege 3388 powercfg.exe Token: SeCreatePagefilePrivilege 3388 powercfg.exe Token: SeShutdownPrivilege 3400 powercfg.exe Token: SeCreatePagefilePrivilege 3400 powercfg.exe Token: SeShutdownPrivilege 2340 powercfg.exe Token: SeCreatePagefilePrivilege 2340 powercfg.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 5080 dialer.exe Token: SeShutdownPrivilege 4864 powercfg.exe Token: SeCreatePagefilePrivilege 4864 powercfg.exe Token: SeShutdownPrivilege 2876 powercfg.exe Token: SeCreatePagefilePrivilege 2876 powercfg.exe Token: SeShutdownPrivilege 3392 powercfg.exe Token: SeCreatePagefilePrivilege 3392 powercfg.exe Token: SeShutdownPrivilege 2108 powercfg.exe Token: SeCreatePagefilePrivilege 2108 powercfg.exe Token: SeLockMemoryPrivilege 344 dialer.exe Token: SeAssignPrimaryTokenPrivilege 2688 svchost.exe Token: SeIncreaseQuotaPrivilege 2688 svchost.exe Token: SeSecurityPrivilege 2688 svchost.exe Token: SeTakeOwnershipPrivilege 2688 svchost.exe Token: SeLoadDriverPrivilege 2688 svchost.exe Token: SeSystemtimePrivilege 2688 svchost.exe Token: SeBackupPrivilege 2688 svchost.exe Token: SeRestorePrivilege 2688 svchost.exe Token: SeShutdownPrivilege 2688 svchost.exe Token: SeSystemEnvironmentPrivilege 2688 svchost.exe Token: SeUndockPrivilege 2688 svchost.exe Token: SeManageVolumePrivilege 2688 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2688 svchost.exe Token: SeIncreaseQuotaPrivilege 2688 svchost.exe Token: SeSecurityPrivilege 2688 svchost.exe Token: SeTakeOwnershipPrivilege 2688 svchost.exe Token: SeLoadDriverPrivilege 2688 svchost.exe Token: SeSystemtimePrivilege 2688 svchost.exe Token: SeBackupPrivilege 2688 svchost.exe Token: SeRestorePrivilege 2688 svchost.exe Token: SeShutdownPrivilege 2688 svchost.exe Token: SeSystemEnvironmentPrivilege 2688 svchost.exe Token: SeUndockPrivilege 2688 svchost.exe Token: SeManageVolumePrivilege 2688 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2688 svchost.exe Token: SeIncreaseQuotaPrivilege 2688 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3296 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
num2.exekanilzbpgdul.execmd.exeMicrosoftEdgeUpdater.exedialer.exelsass.exedescription pid process target process PID 4584 wrote to memory of 4676 4584 num2.exe jhi_service.exe PID 4584 wrote to memory of 4676 4584 num2.exe jhi_service.exe PID 4584 wrote to memory of 4748 4584 num2.exe MicrosoftEdgeUpdater.exe PID 4584 wrote to memory of 4748 4584 num2.exe MicrosoftEdgeUpdater.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4924 2536 kanilzbpgdul.exe conhost.exe PID 2536 wrote to memory of 4512 2536 kanilzbpgdul.exe svchost.exe PID 2536 wrote to memory of 4512 2536 kanilzbpgdul.exe svchost.exe PID 2536 wrote to memory of 4512 2536 kanilzbpgdul.exe svchost.exe PID 2536 wrote to memory of 4512 2536 kanilzbpgdul.exe svchost.exe PID 2536 wrote to memory of 4512 2536 kanilzbpgdul.exe svchost.exe PID 4256 wrote to memory of 3116 4256 cmd.exe wusa.exe PID 4256 wrote to memory of 3116 4256 cmd.exe wusa.exe PID 4748 wrote to memory of 972 4748 MicrosoftEdgeUpdater.exe dialer.exe PID 4748 wrote to memory of 972 4748 MicrosoftEdgeUpdater.exe dialer.exe PID 4748 wrote to memory of 972 4748 MicrosoftEdgeUpdater.exe dialer.exe PID 4748 wrote to memory of 972 4748 MicrosoftEdgeUpdater.exe dialer.exe PID 4748 wrote to memory of 972 4748 MicrosoftEdgeUpdater.exe dialer.exe PID 4748 wrote to memory of 972 4748 MicrosoftEdgeUpdater.exe dialer.exe PID 4748 wrote to memory of 972 4748 MicrosoftEdgeUpdater.exe dialer.exe PID 972 wrote to memory of 652 972 dialer.exe winlogon.exe PID 972 wrote to memory of 708 972 dialer.exe lsass.exe PID 972 wrote to memory of 992 972 dialer.exe svchost.exe PID 972 wrote to memory of 568 972 dialer.exe dwm.exe PID 972 wrote to memory of 548 972 dialer.exe svchost.exe PID 708 wrote to memory of 2644 708 lsass.exe sysmon.exe PID 972 wrote to memory of 780 972 dialer.exe svchost.exe PID 972 wrote to memory of 1060 972 dialer.exe svchost.exe PID 972 wrote to memory of 1104 972 dialer.exe svchost.exe PID 972 wrote to memory of 1128 972 dialer.exe svchost.exe PID 972 wrote to memory of 1204 972 dialer.exe svchost.exe PID 972 wrote to memory of 1280 972 dialer.exe svchost.exe PID 972 wrote to memory of 1288 972 dialer.exe svchost.exe PID 972 wrote to memory of 1420 972 dialer.exe svchost.exe PID 972 wrote to memory of 1428 972 dialer.exe svchost.exe PID 972 wrote to memory of 1524 972 dialer.exe svchost.exe PID 972 wrote to memory of 1536 972 dialer.exe svchost.exe PID 972 wrote to memory of 1692 972 dialer.exe svchost.exe PID 972 wrote to memory of 1736 972 dialer.exe svchost.exe PID 972 wrote to memory of 1780 972 dialer.exe svchost.exe PID 972 wrote to memory of 1796 972 dialer.exe svchost.exe PID 972 wrote to memory of 1832 972 dialer.exe svchost.exe PID 972 wrote to memory of 1840 972 dialer.exe svchost.exe PID 972 wrote to memory of 1860 972 dialer.exe svchost.exe PID 972 wrote to memory of 1940 972 dialer.exe svchost.exe PID 972 wrote to memory of 1948 972 dialer.exe svchost.exe PID 972 wrote to memory of 2132 972 dialer.exe spoolsv.exe PID 972 wrote to memory of 2244 972 dialer.exe svchost.exe PID 972 wrote to memory of 2428 972 dialer.exe svchost.exe PID 972 wrote to memory of 2540 972 dialer.exe svchost.exe PID 972 wrote to memory of 2548 972 dialer.exe svchost.exe PID 972 wrote to memory of 2576 972 dialer.exe svchost.exe PID 972 wrote to memory of 2644 972 dialer.exe sysmon.exe PID 972 wrote to memory of 2652 972 dialer.exe svchost.exe PID 972 wrote to memory of 2680 972 dialer.exe svchost.exe PID 972 wrote to memory of 2688 972 dialer.exe svchost.exe PID 972 wrote to memory of 2696 972 dialer.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:652
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:568
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:992
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:780
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1204
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1428
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:3068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1524
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1780
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1796
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1860
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1948
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2132
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2244
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2576
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2652
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2300
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3088
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe"C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4676 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:3756 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:4612 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "HDNFMUHS"4⤵
- Launches sc.exe
PID:4260 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"4⤵
- Launches sc.exe
PID:2624 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:3760 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "HDNFMUHS"4⤵
- Launches sc.exe
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵PID:3116
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
PID:2392 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
PID:804 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
PID:1344 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
PID:4684 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
PID:2872 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:3388 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:3400 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
PID:3332 -
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "YWZWALUU"4⤵
- Launches sc.exe
PID:344 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"4⤵
- Launches sc.exe
PID:736 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:4012 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "YWZWALUU"4⤵
- Launches sc.exe
PID:440 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3440
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3804
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3864
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:3980
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵PID:4384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:988
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:1032
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
PID:1200
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:2460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4120
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4520
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2164
-
C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exeC:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4968 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2376 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4924
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks processor information in registry
PID:788
-
C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exeC:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4280 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3760
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:2124
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5104
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:5060
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4264 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2952
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4112 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2900 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2904
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1044 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2536
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4964 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4088
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4132
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3828
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4420
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1052
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5080 -
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵PID:2008
-
C:\Windows\system32\dialer.exedialer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:344
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD519c095e1c399bdaa0663caa9162f0b0e
SHA1cb5504712ec965f7c43883f2f251823755b1e37e
SHA25638edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
SHA512a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9
-
Filesize
2.5MB
MD51994ad04639f3d12c7bbfa37feb3434f
SHA14979247e5a9771286a91827851527e5dbfb80c8e
SHA256c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c
SHA512adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82