Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 03:37
Static task
static1
Behavioral task
behavioral1
Sample
78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe
Resource
win7-20240903-en
General
-
Target
78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe
-
Size
5.5MB
-
MD5
dac0102fcb9fb02f7f6291cda42a4030
-
SHA1
c7aa519f4d39962f84e89e386e015925d66784fb
-
SHA256
78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645
-
SHA512
053fb5b8309eea2326346eaae3cca3bf4df2f5fb85ba9ab0b314fdb645fe609b8a1a7e85e22e9546a6609b7904584849a22b3ac15805cc7a42000ce9f59c8355
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/2492-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2492-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4256 powershell.exe 4796 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 1244 lutlgidagtja.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4012 powercfg.exe 4212 powercfg.exe 4348 powercfg.exe 4556 powercfg.exe 1292 powercfg.exe 1940 powercfg.exe 1560 powercfg.exe 3608 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1244 set thread context of 4708 1244 lutlgidagtja.exe 145 PID 1244 set thread context of 2492 1244 lutlgidagtja.exe 150 -
resource yara_rule behavioral2/memory/2492-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2492-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2440 sc.exe 4220 sc.exe 1680 sc.exe 1036 sc.exe 4480 sc.exe 4872 sc.exe 4328 sc.exe 4780 sc.exe 892 sc.exe 4636 sc.exe 3464 sc.exe 2220 sc.exe 3996 sc.exe 3128 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 4256 powershell.exe 4256 powershell.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 3984 78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe 1244 lutlgidagtja.exe 4796 powershell.exe 4796 powershell.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 1244 lutlgidagtja.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe 2492 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4256 powershell.exe Token: SeShutdownPrivilege 4012 powercfg.exe Token: SeCreatePagefilePrivilege 4012 powercfg.exe Token: SeShutdownPrivilege 3608 powercfg.exe Token: SeCreatePagefilePrivilege 3608 powercfg.exe Token: SeShutdownPrivilege 4348 powercfg.exe Token: SeCreatePagefilePrivilege 4348 powercfg.exe Token: SeShutdownPrivilege 4212 powercfg.exe Token: SeCreatePagefilePrivilege 4212 powercfg.exe Token: SeDebugPrivilege 4796 powershell.exe Token: SeShutdownPrivilege 1940 powercfg.exe Token: SeCreatePagefilePrivilege 1940 powercfg.exe Token: SeShutdownPrivilege 1560 powercfg.exe Token: SeCreatePagefilePrivilege 1560 powercfg.exe Token: SeShutdownPrivilege 4556 powercfg.exe Token: SeCreatePagefilePrivilege 4556 powercfg.exe Token: SeLockMemoryPrivilege 2492 nslookup.exe Token: SeShutdownPrivilege 1292 powercfg.exe Token: SeCreatePagefilePrivilege 1292 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4176 2604 cmd.exe 96 PID 2604 wrote to memory of 4176 2604 cmd.exe 96 PID 1980 wrote to memory of 3800 1980 cmd.exe 125 PID 1980 wrote to memory of 3800 1980 cmd.exe 125 PID 4716 wrote to memory of 2136 4716 cmd.exe 132 PID 4716 wrote to memory of 2136 4716 cmd.exe 132 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 4708 1244 lutlgidagtja.exe 145 PID 1244 wrote to memory of 2492 1244 lutlgidagtja.exe 150 PID 1244 wrote to memory of 2492 1244 lutlgidagtja.exe 150 PID 1244 wrote to memory of 2492 1244 lutlgidagtja.exe 150 PID 1244 wrote to memory of 2492 1244 lutlgidagtja.exe 150 PID 1244 wrote to memory of 2492 1244 lutlgidagtja.exe 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe"C:\Users\Admin\AppData\Local\Temp\78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3984 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4176
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3996
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4780
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3128
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4220
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1680
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:1036
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:4636
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:3464
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:2440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\78a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3800
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2136
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4480
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:892
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4872
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4328
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2220
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4708
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5dac0102fcb9fb02f7f6291cda42a4030
SHA1c7aa519f4d39962f84e89e386e015925d66784fb
SHA25678a9fe868da68c2b99d031d0e268062d07e5793f37e1a1d7f22eaf69cf2ef645
SHA512053fb5b8309eea2326346eaae3cca3bf4df2f5fb85ba9ab0b314fdb645fe609b8a1a7e85e22e9546a6609b7904584849a22b3ac15805cc7a42000ce9f59c8355
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82