Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe
Resource
win7-20240903-en
General
-
Target
fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe
-
Size
5.5MB
-
MD5
86768db277a51c913ff38d06cb6a08e0
-
SHA1
3d285966e8dca5e08e6d0d07eb64051d38f28e16
-
SHA256
fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0db
-
SHA512
88514b3cc31ba3e51931a5f6347c2f101733e7949fa73eb1bd11397154887a94e3b940d7a80a19573c59b8e2acfeda7b1dfdc298475f01326df4f9e5eebf22f2
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/608-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/608-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5048 powershell.exe 3440 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 4896 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4644 powercfg.exe 5036 powercfg.exe 2708 powercfg.exe 1688 powercfg.exe 744 powercfg.exe 3180 powercfg.exe 4588 powercfg.exe 884 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4896 set thread context of 4272 4896 fqwofdtexigy.exe 144 PID 4896 set thread context of 608 4896 fqwofdtexigy.exe 149 -
resource yara_rule behavioral2/memory/608-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/608-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3548 sc.exe 4732 sc.exe 5064 sc.exe 4304 sc.exe 1348 sc.exe 1856 sc.exe 3148 sc.exe 1896 sc.exe 4864 sc.exe 2148 sc.exe 1832 sc.exe 2032 sc.exe 4812 sc.exe 5056 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 5048 powershell.exe 5048 powershell.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 2156 fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe 4896 fqwofdtexigy.exe 3440 powershell.exe 3440 powershell.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 4896 fqwofdtexigy.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe 608 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 5048 powershell.exe Token: SeShutdownPrivilege 4644 powercfg.exe Token: SeCreatePagefilePrivilege 4644 powercfg.exe Token: SeShutdownPrivilege 3180 powercfg.exe Token: SeCreatePagefilePrivilege 3180 powercfg.exe Token: SeShutdownPrivilege 4588 powercfg.exe Token: SeCreatePagefilePrivilege 4588 powercfg.exe Token: SeShutdownPrivilege 884 powercfg.exe Token: SeCreatePagefilePrivilege 884 powercfg.exe Token: SeDebugPrivilege 3440 powershell.exe Token: SeShutdownPrivilege 5036 powercfg.exe Token: SeCreatePagefilePrivilege 5036 powercfg.exe Token: SeShutdownPrivilege 744 powercfg.exe Token: SeCreatePagefilePrivilege 744 powercfg.exe Token: SeShutdownPrivilege 1688 powercfg.exe Token: SeCreatePagefilePrivilege 1688 powercfg.exe Token: SeShutdownPrivilege 2708 powercfg.exe Token: SeCreatePagefilePrivilege 2708 powercfg.exe Token: SeLockMemoryPrivilege 608 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1332 wrote to memory of 4484 1332 cmd.exe 96 PID 1332 wrote to memory of 4484 1332 cmd.exe 96 PID 2472 wrote to memory of 4340 2472 cmd.exe 123 PID 2472 wrote to memory of 4340 2472 cmd.exe 123 PID 1132 wrote to memory of 3992 1132 cmd.exe 131 PID 1132 wrote to memory of 3992 1132 cmd.exe 131 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 4272 4896 fqwofdtexigy.exe 144 PID 4896 wrote to memory of 608 4896 fqwofdtexigy.exe 149 PID 4896 wrote to memory of 608 4896 fqwofdtexigy.exe 149 PID 4896 wrote to memory of 608 4896 fqwofdtexigy.exe 149 PID 4896 wrote to memory of 608 4896 fqwofdtexigy.exe 149 PID 4896 wrote to memory of 608 4896 fqwofdtexigy.exe 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe"C:\Users\Admin\AppData\Local\Temp\fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2156 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4484
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3148
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4812
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4864
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2148
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:5056
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:884
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:1832
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:1896
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:5064
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:2032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0dbN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4340
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3992
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1348
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1856
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4304
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3548
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4732
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4272
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD586768db277a51c913ff38d06cb6a08e0
SHA13d285966e8dca5e08e6d0d07eb64051d38f28e16
SHA256fae3daf50a623895e8962d8487f875f50419921be9c0e63c03306c58f49fd0db
SHA51288514b3cc31ba3e51931a5f6347c2f101733e7949fa73eb1bd11397154887a94e3b940d7a80a19573c59b8e2acfeda7b1dfdc298475f01326df4f9e5eebf22f2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82