Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe
Resource
win7-20240704-en
General
-
Target
f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe
-
Size
5.4MB
-
MD5
5ba8de69f6fa6eb0c7cb40c86786fa67
-
SHA1
341030b3a841917d0aae815648450b75f563c1b6
-
SHA256
f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e
-
SHA512
ea7695fa70fec6f94a501c25779c7a641f21f606721a66824b7a735e42e1879853aa8856133a637577fe90f68cd4131ca2c45c74b96f3ad9334e6da566c001d1
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/2036-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2036-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2916 powershell.exe 4616 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 1964 fqwofdtexigy.exe -
resource yara_rule behavioral2/memory/2036-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2036-72-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4324 powercfg.exe 4380 powercfg.exe 2624 powercfg.exe 4916 powercfg.exe 820 powercfg.exe 3756 powercfg.exe 2044 powercfg.exe 4316 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1964 set thread context of 4344 1964 fqwofdtexigy.exe 149 PID 1964 set thread context of 2036 1964 fqwofdtexigy.exe 152 -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3988 sc.exe 2008 sc.exe 3936 sc.exe 2304 sc.exe 1380 sc.exe 4888 sc.exe 2716 sc.exe 2188 sc.exe 2600 sc.exe 1656 sc.exe 4364 sc.exe 2200 sc.exe 3624 sc.exe 868 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2916 powershell.exe 2916 powershell.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 2564 f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe 1964 fqwofdtexigy.exe 4616 powershell.exe 4616 powershell.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 1964 fqwofdtexigy.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe 2036 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 2916 powershell.exe Token: SeShutdownPrivilege 4316 powercfg.exe Token: SeCreatePagefilePrivilege 4316 powercfg.exe Token: SeShutdownPrivilege 4380 powercfg.exe Token: SeCreatePagefilePrivilege 4380 powercfg.exe Token: SeShutdownPrivilege 4324 powercfg.exe Token: SeCreatePagefilePrivilege 4324 powercfg.exe Token: SeShutdownPrivilege 2044 powercfg.exe Token: SeCreatePagefilePrivilege 2044 powercfg.exe Token: SeDebugPrivilege 4616 powershell.exe Token: SeLockMemoryPrivilege 2036 nslookup.exe Token: SeShutdownPrivilege 820 powercfg.exe Token: SeCreatePagefilePrivilege 820 powercfg.exe Token: SeShutdownPrivilege 3756 powercfg.exe Token: SeCreatePagefilePrivilege 3756 powercfg.exe Token: SeShutdownPrivilege 2624 powercfg.exe Token: SeCreatePagefilePrivilege 2624 powercfg.exe Token: SeShutdownPrivilege 4916 powercfg.exe Token: SeCreatePagefilePrivilege 4916 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3396 1536 cmd.exe 101 PID 1536 wrote to memory of 3396 1536 cmd.exe 101 PID 5108 wrote to memory of 512 5108 cmd.exe 129 PID 5108 wrote to memory of 512 5108 cmd.exe 129 PID 844 wrote to memory of 4092 844 cmd.exe 136 PID 844 wrote to memory of 4092 844 cmd.exe 136 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 4344 1964 fqwofdtexigy.exe 149 PID 1964 wrote to memory of 2036 1964 fqwofdtexigy.exe 152 PID 1964 wrote to memory of 2036 1964 fqwofdtexigy.exe 152 PID 1964 wrote to memory of 2036 1964 fqwofdtexigy.exe 152 PID 1964 wrote to memory of 2036 1964 fqwofdtexigy.exe 152 PID 1964 wrote to memory of 2036 1964 fqwofdtexigy.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe"C:\Users\Admin\AppData\Local\Temp\f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2564 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3396
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2008
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3624
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2188
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2600
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:1656
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:2304
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4364
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:1380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:512
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4092
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4888
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3936
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3988
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2200
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2716
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4344
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD55ba8de69f6fa6eb0c7cb40c86786fa67
SHA1341030b3a841917d0aae815648450b75f563c1b6
SHA256f2ad64444728ac792d75c7450e1bf9d5f988916083075e015f6bd450c611829e
SHA512ea7695fa70fec6f94a501c25779c7a641f21f606721a66824b7a735e42e1879853aa8856133a637577fe90f68cd4131ca2c45c74b96f3ad9334e6da566c001d1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82