Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
ce1b63640a790ae744465f4da7af75d0N.exe
Resource
win7-20240903-en
General
-
Target
ce1b63640a790ae744465f4da7af75d0N.exe
-
Size
5.3MB
-
MD5
ce1b63640a790ae744465f4da7af75d0
-
SHA1
dde7e919e329826d2bc0d2ff4ba01005ba48c52d
-
SHA256
d4c216bab338d7fa68e1b13e9eb4d63dc2360fd7403527834e6a4aed4fbfaf40
-
SHA512
aee4591fd5c0c477f577416a35ba2080cbb2d482efc5d5fc509761054495316cd41f6f97a30c999de36f6f5cda7a5d093add244d2e0a9b6210d152bd8793e741
-
SSDEEP
98304:34Gr/W2hRkTwVNt6MkTi+XAVd18EjU6+cVX6IwUu:3jr/TMwVNtaP4KEjl6S
Malware Config
Signatures
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/1556-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1556-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3432 powershell.exe 3352 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 4824 dddbhxbblxrl.exe -
resource yara_rule behavioral2/memory/1556-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1556-74-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4072 powercfg.exe 2412 powercfg.exe 1312 powercfg.exe 1368 powercfg.exe 672 powercfg.exe 3944 powercfg.exe 4932 powercfg.exe 4340 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe ce1b63640a790ae744465f4da7af75d0N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe dddbhxbblxrl.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4824 set thread context of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 set thread context of 1556 4824 dddbhxbblxrl.exe 160 -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1212 sc.exe 3276 sc.exe 3580 sc.exe 4340 sc.exe 4064 sc.exe 3140 sc.exe 4328 sc.exe 1224 sc.exe 4332 sc.exe 4348 sc.exe 1856 sc.exe 2008 sc.exe 3532 sc.exe 3972 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4564 ce1b63640a790ae744465f4da7af75d0N.exe 3432 powershell.exe 3432 powershell.exe 3432 powershell.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4564 ce1b63640a790ae744465f4da7af75d0N.exe 4824 dddbhxbblxrl.exe 3352 powershell.exe 3352 powershell.exe 3352 powershell.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 4824 dddbhxbblxrl.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe 1556 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3432 powershell.exe Token: SeShutdownPrivilege 1368 powercfg.exe Token: SeCreatePagefilePrivilege 1368 powercfg.exe Token: SeShutdownPrivilege 1312 powercfg.exe Token: SeCreatePagefilePrivilege 1312 powercfg.exe Token: SeShutdownPrivilege 672 powercfg.exe Token: SeCreatePagefilePrivilege 672 powercfg.exe Token: SeShutdownPrivilege 2412 powercfg.exe Token: SeCreatePagefilePrivilege 2412 powercfg.exe Token: SeDebugPrivilege 3352 powershell.exe Token: SeShutdownPrivilege 4340 powercfg.exe Token: SeCreatePagefilePrivilege 4340 powercfg.exe Token: SeShutdownPrivilege 4932 powercfg.exe Token: SeCreatePagefilePrivilege 4932 powercfg.exe Token: SeLockMemoryPrivilege 1556 nslookup.exe Token: SeShutdownPrivilege 4072 powercfg.exe Token: SeCreatePagefilePrivilege 4072 powercfg.exe Token: SeShutdownPrivilege 3944 powercfg.exe Token: SeCreatePagefilePrivilege 3944 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4084 wrote to memory of 1628 4084 cmd.exe 107 PID 4084 wrote to memory of 1628 4084 cmd.exe 107 PID 3080 wrote to memory of 1832 3080 cmd.exe 134 PID 3080 wrote to memory of 1832 3080 cmd.exe 134 PID 1908 wrote to memory of 2368 1908 cmd.exe 142 PID 1908 wrote to memory of 2368 1908 cmd.exe 142 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 4544 4824 dddbhxbblxrl.exe 155 PID 4824 wrote to memory of 1556 4824 dddbhxbblxrl.exe 160 PID 4824 wrote to memory of 1556 4824 dddbhxbblxrl.exe 160 PID 4824 wrote to memory of 1556 4824 dddbhxbblxrl.exe 160 PID 4824 wrote to memory of 1556 4824 dddbhxbblxrl.exe 160 PID 4824 wrote to memory of 1556 4824 dddbhxbblxrl.exe 160
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce1b63640a790ae744465f4da7af75d0N.exe"C:\Users\Admin\AppData\Local\Temp\ce1b63640a790ae744465f4da7af75d0N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4564 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1628
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1212
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4348
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3276
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1856
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4340
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:672
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "NCUDPJVW"2⤵
- Launches sc.exe
PID:2008
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "NCUDPJVW" binpath= "C:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exe" start= "auto"2⤵
- Launches sc.exe
PID:3140
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:3532
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "NCUDPJVW"2⤵
- Launches sc.exe
PID:3972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\ce1b63640a790ae744465f4da7af75d0N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1832
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4308,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:81⤵PID:4284
-
C:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exeC:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2368
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1224
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3580
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4064
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4332
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4328
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4544
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD5ce1b63640a790ae744465f4da7af75d0
SHA1dde7e919e329826d2bc0d2ff4ba01005ba48c52d
SHA256d4c216bab338d7fa68e1b13e9eb4d63dc2360fd7403527834e6a4aed4fbfaf40
SHA512aee4591fd5c0c477f577416a35ba2080cbb2d482efc5d5fc509761054495316cd41f6f97a30c999de36f6f5cda7a5d093add244d2e0a9b6210d152bd8793e741
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82