Analysis
-
max time kernel
35s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2024 05:06
Static task
static1
Behavioral task
behavioral1
Sample
mmpack/mmpack.exe
Resource
win10v2004-20240802-en
General
-
Target
mmpack/mmpack.exe
-
Size
785.9MB
-
MD5
17fa54200d0a4a000d5efbf602b8a0e6
-
SHA1
b843e32e8116bf481a25c2849cc14e9df89e902d
-
SHA256
d3fa6f22e10ed36f833ce25a16f7bf93eaf0c5e9b5e3ddd5203c73c11a98e71b
-
SHA512
b25e8ec4d0e0b28aa51c15fc6394b807faba9b2004921e0186f380a72249a24cbb129d2c71a5a6dcd67485c7954524729151b360161b34602b6bc9fb90c7ca1b
-
SSDEEP
49152:bvvAQlU+7RzxP5z5ASE3MkiGgFDXtuCsVsvcrb6FMbSuvUkt77:s6RzxP5z5A93MkiGgFLtuCtvcrbXUo77
Malware Config
Extracted
rhadamanthys
https://api.assasasasasas.shop/c40a79fd692ba05/jvjt0idu.tvxhs
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
RegAsm.exedescription pid process target process PID 4748 created 2532 4748 RegAsm.exe sihost.exe -
XMRig Miner payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1460-129-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1460-136-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1460-139-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1460-140-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1460-137-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1460-138-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1460-128-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2732 powershell.exe 832 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
MediaLA.exeAura.exemiwdfurfmpfu.exepid process 2096 MediaLA.exe 3988 Aura.exe 1764 miwdfurfmpfu.exe -
Processes:
resource yara_rule behavioral1/memory/1460-124-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-129-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-136-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-139-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-140-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-137-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-138-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-128-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-126-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-125-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-123-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1460-127-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
MediaLA.exemiwdfurfmpfu.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe MediaLA.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{1B0A8219-77D82B3F-70E3AD25-F217139E} miwdfurfmpfu.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{1B0A8219-77D82B3F-70E3AD25-F217139E}\1764.obs miwdfurfmpfu.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe miwdfurfmpfu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
MediaLA.exemiwdfurfmpfu.exepid process 2096 MediaLA.exe 1764 miwdfurfmpfu.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Aura.exemiwdfurfmpfu.exedescription pid process target process PID 3988 set thread context of 4748 3988 Aura.exe RegAsm.exe PID 1764 set thread context of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 set thread context of 1460 1764 miwdfurfmpfu.exe explorer.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4880 sc.exe 3764 sc.exe 1328 sc.exe 2576 sc.exe 1832 sc.exe 2448 sc.exe 2768 sc.exe 4644 sc.exe 2056 sc.exe 4560 sc.exe 3488 sc.exe 1072 sc.exe 1448 sc.exe 1028 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Aura.exeRegAsm.exedialer.exemmpack.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aura.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmpack.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
MediaLA.exeRegAsm.exedialer.exepowershell.exemiwdfurfmpfu.exepowershell.exepid process 2096 MediaLA.exe 2096 MediaLA.exe 4748 RegAsm.exe 4748 RegAsm.exe 216 dialer.exe 216 dialer.exe 216 dialer.exe 216 dialer.exe 2096 MediaLA.exe 2732 powershell.exe 2732 powershell.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 2096 MediaLA.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe 832 powershell.exe 832 powershell.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe 1764 miwdfurfmpfu.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 832 powershell.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
mmpack.exeAura.exeRegAsm.execmd.execmd.execmd.exemiwdfurfmpfu.exedescription pid process target process PID 2476 wrote to memory of 2096 2476 mmpack.exe MediaLA.exe PID 2476 wrote to memory of 2096 2476 mmpack.exe MediaLA.exe PID 2476 wrote to memory of 3988 2476 mmpack.exe Aura.exe PID 2476 wrote to memory of 3988 2476 mmpack.exe Aura.exe PID 2476 wrote to memory of 3988 2476 mmpack.exe Aura.exe PID 3988 wrote to memory of 4748 3988 Aura.exe RegAsm.exe PID 3988 wrote to memory of 4748 3988 Aura.exe RegAsm.exe PID 3988 wrote to memory of 4748 3988 Aura.exe RegAsm.exe PID 3988 wrote to memory of 4748 3988 Aura.exe RegAsm.exe PID 3988 wrote to memory of 4748 3988 Aura.exe RegAsm.exe PID 3988 wrote to memory of 4748 3988 Aura.exe RegAsm.exe PID 3988 wrote to memory of 4748 3988 Aura.exe RegAsm.exe PID 3988 wrote to memory of 4748 3988 Aura.exe RegAsm.exe PID 4748 wrote to memory of 216 4748 RegAsm.exe dialer.exe PID 4748 wrote to memory of 216 4748 RegAsm.exe dialer.exe PID 4748 wrote to memory of 216 4748 RegAsm.exe dialer.exe PID 4748 wrote to memory of 216 4748 RegAsm.exe dialer.exe PID 4748 wrote to memory of 216 4748 RegAsm.exe dialer.exe PID 4928 wrote to memory of 1908 4928 cmd.exe wusa.exe PID 4928 wrote to memory of 1908 4928 cmd.exe wusa.exe PID 2696 wrote to memory of 4092 2696 cmd.exe choice.exe PID 2696 wrote to memory of 4092 2696 cmd.exe choice.exe PID 392 wrote to memory of 4632 392 cmd.exe wusa.exe PID 392 wrote to memory of 4632 392 cmd.exe wusa.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 2240 1764 miwdfurfmpfu.exe conhost.exe PID 1764 wrote to memory of 1460 1764 miwdfurfmpfu.exe explorer.exe PID 1764 wrote to memory of 1460 1764 miwdfurfmpfu.exe explorer.exe PID 1764 wrote to memory of 1460 1764 miwdfurfmpfu.exe explorer.exe PID 1764 wrote to memory of 1460 1764 miwdfurfmpfu.exe explorer.exe PID 1764 wrote to memory of 1460 1764 miwdfurfmpfu.exe explorer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2532
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
C:\Users\Admin\AppData\Local\Temp\mmpack\mmpack.exe"C:\Users\Admin\AppData\Local\Temp\mmpack\mmpack.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Roaming\MediaLA.exeC:\Users\Admin\AppData\Roaming\MediaLA.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2096 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:1908
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:1832
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:3764
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:1448
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:4560
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:1028
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "NVIDlA"3⤵
- Launches sc.exe
PID:3488
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "NVIDlA" binpath= "C:\ProgramData\Audiocodek\miwdfurfmpfu.exe" start= "auto"3⤵
- Launches sc.exe
PID:2448
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:2576
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "NVIDlA"3⤵
- Launches sc.exe
PID:2768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\MediaLA.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4092
-
-
-
-
C:\Users\Admin\AppData\Roaming\Aura.exeC:\Users\Admin\AppData\Roaming\Aura.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748
-
-
-
C:\ProgramData\Audiocodek\miwdfurfmpfu.exeC:\ProgramData\Audiocodek\miwdfurfmpfu.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4632
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4644
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2056
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1072
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1328
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4880
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2240
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:1460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82