Analysis
-
max time kernel
120s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 10:12
Static task
static1
Behavioral task
behavioral1
Sample
8d2ada919248d1765bc22c79e78300f0N.exe
Resource
win7-20240729-en
General
-
Target
8d2ada919248d1765bc22c79e78300f0N.exe
-
Size
5.4MB
-
MD5
8d2ada919248d1765bc22c79e78300f0
-
SHA1
7cd9b3a95a15e31efa388c2eaa46efc39d530bf7
-
SHA256
ea18e9ea48e9283c8a82cb264764997f3e237608b8f73c20918ccbbaa71fa7dc
-
SHA512
91ace3b6b030d53eba94dd9e245007b8a44773ce5d9d4026713e6b5a64a0f991f699c90976010d1e9a9de78b892ee95c9cc1aae0abd24ac950bec2441dc8c7bf
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/2960-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2960-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4248 powershell.exe 3964 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 1992 lutlgidagtja.exe -
resource yara_rule behavioral2/memory/2960-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2960-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1624 powercfg.exe 220 powercfg.exe 2876 powercfg.exe 3160 powercfg.exe 3380 powercfg.exe 1168 powercfg.exe 632 powercfg.exe 1592 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 8d2ada919248d1765bc22c79e78300f0N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1992 set thread context of 4176 1992 lutlgidagtja.exe 141 PID 1992 set thread context of 2960 1992 lutlgidagtja.exe 144 -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2472 sc.exe 2744 sc.exe 3980 sc.exe 4372 sc.exe 3184 sc.exe 3516 sc.exe 2608 sc.exe 2148 sc.exe 3572 sc.exe 4280 sc.exe 1164 sc.exe 5116 sc.exe 2064 sc.exe 2400 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4248 powershell.exe 4248 powershell.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 4696 8d2ada919248d1765bc22c79e78300f0N.exe 1992 lutlgidagtja.exe 3964 powershell.exe 3964 powershell.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 1992 lutlgidagtja.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe 2960 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4248 powershell.exe Token: SeShutdownPrivilege 632 powercfg.exe Token: SeCreatePagefilePrivilege 632 powercfg.exe Token: SeShutdownPrivilege 1624 powercfg.exe Token: SeCreatePagefilePrivilege 1624 powercfg.exe Token: SeShutdownPrivilege 220 powercfg.exe Token: SeCreatePagefilePrivilege 220 powercfg.exe Token: SeShutdownPrivilege 1592 powercfg.exe Token: SeCreatePagefilePrivilege 1592 powercfg.exe Token: SeDebugPrivilege 3964 powershell.exe Token: SeLockMemoryPrivilege 2960 nslookup.exe Token: SeShutdownPrivilege 1168 powercfg.exe Token: SeCreatePagefilePrivilege 1168 powercfg.exe Token: SeShutdownPrivilege 3160 powercfg.exe Token: SeCreatePagefilePrivilege 3160 powercfg.exe Token: SeShutdownPrivilege 3380 powercfg.exe Token: SeCreatePagefilePrivilege 3380 powercfg.exe Token: SeShutdownPrivilege 2876 powercfg.exe Token: SeCreatePagefilePrivilege 2876 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2456 1336 cmd.exe 93 PID 1336 wrote to memory of 2456 1336 cmd.exe 93 PID 1888 wrote to memory of 4920 1888 cmd.exe 119 PID 1888 wrote to memory of 4920 1888 cmd.exe 119 PID 1900 wrote to memory of 2056 1900 cmd.exe 127 PID 1900 wrote to memory of 2056 1900 cmd.exe 127 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 4176 1992 lutlgidagtja.exe 141 PID 1992 wrote to memory of 2960 1992 lutlgidagtja.exe 144 PID 1992 wrote to memory of 2960 1992 lutlgidagtja.exe 144 PID 1992 wrote to memory of 2960 1992 lutlgidagtja.exe 144 PID 1992 wrote to memory of 2960 1992 lutlgidagtja.exe 144 PID 1992 wrote to memory of 2960 1992 lutlgidagtja.exe 144
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d2ada919248d1765bc22c79e78300f0N.exe"C:\Users\Admin\AppData\Local\Temp\8d2ada919248d1765bc22c79e78300f0N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4696 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2456
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3184
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2472
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3516
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3572
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2608
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:2148
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:2064
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2744
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:3980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\8d2ada919248d1765bc22c79e78300f0N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4920
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2056
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4372
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4280
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1164
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:5116
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2400
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4176
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD58d2ada919248d1765bc22c79e78300f0
SHA17cd9b3a95a15e31efa388c2eaa46efc39d530bf7
SHA256ea18e9ea48e9283c8a82cb264764997f3e237608b8f73c20918ccbbaa71fa7dc
SHA51291ace3b6b030d53eba94dd9e245007b8a44773ce5d9d4026713e6b5a64a0f991f699c90976010d1e9a9de78b892ee95c9cc1aae0abd24ac950bec2441dc8c7bf
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82