Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe
Resource
win7-20241010-en
General
-
Target
3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe
-
Size
5.5MB
-
MD5
e5629c2b0355884c7a022372c1a5e160
-
SHA1
ba6c548fe73f1803797a8a93b6033ca4ba4af1eb
-
SHA256
3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775c
-
SHA512
523f09776fa764bb1b9e1b6465aaa3e44a9be0dafc662db197b9578451c6620a28a7f9e286652fcf0514ff6b4eb8b5c2ebba263afe764e085db4b911bc1e5281
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/4896-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4896-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4752 powershell.exe 1040 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 644 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2112 powercfg.exe 4212 powercfg.exe 1172 powercfg.exe 4008 powercfg.exe 3580 powercfg.exe 4120 powercfg.exe 1480 powercfg.exe 432 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 644 set thread context of 864 644 fqwofdtexigy.exe 153 PID 644 set thread context of 4896 644 fqwofdtexigy.exe 158 -
resource yara_rule behavioral2/memory/4896-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4896-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1504 sc.exe 4468 sc.exe 1772 sc.exe 916 sc.exe 4624 sc.exe 1148 sc.exe 2660 sc.exe 1908 sc.exe 2552 sc.exe 2224 sc.exe 3388 sc.exe 2988 sc.exe 1492 sc.exe 1812 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 4752 powershell.exe 4752 powershell.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 5100 3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe 644 fqwofdtexigy.exe 1040 powershell.exe 1040 powershell.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 644 fqwofdtexigy.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe 4896 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4752 powershell.exe Token: SeShutdownPrivilege 432 powercfg.exe Token: SeCreatePagefilePrivilege 432 powercfg.exe Token: SeShutdownPrivilege 2112 powercfg.exe Token: SeCreatePagefilePrivilege 2112 powercfg.exe Token: SeShutdownPrivilege 4212 powercfg.exe Token: SeCreatePagefilePrivilege 4212 powercfg.exe Token: SeShutdownPrivilege 1480 powercfg.exe Token: SeCreatePagefilePrivilege 1480 powercfg.exe Token: SeDebugPrivilege 1040 powershell.exe Token: SeShutdownPrivilege 4120 powercfg.exe Token: SeCreatePagefilePrivilege 4120 powercfg.exe Token: SeShutdownPrivilege 4008 powercfg.exe Token: SeCreatePagefilePrivilege 4008 powercfg.exe Token: SeShutdownPrivilege 3580 powercfg.exe Token: SeCreatePagefilePrivilege 3580 powercfg.exe Token: SeShutdownPrivilege 1172 powercfg.exe Token: SeCreatePagefilePrivilege 1172 powercfg.exe Token: SeLockMemoryPrivilege 4896 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4888 wrote to memory of 3256 4888 cmd.exe 105 PID 4888 wrote to memory of 3256 4888 cmd.exe 105 PID 4452 wrote to memory of 4720 4452 cmd.exe 132 PID 4452 wrote to memory of 4720 4452 cmd.exe 132 PID 4404 wrote to memory of 892 4404 cmd.exe 140 PID 4404 wrote to memory of 892 4404 cmd.exe 140 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 864 644 fqwofdtexigy.exe 153 PID 644 wrote to memory of 4896 644 fqwofdtexigy.exe 158 PID 644 wrote to memory of 4896 644 fqwofdtexigy.exe 158 PID 644 wrote to memory of 4896 644 fqwofdtexigy.exe 158 PID 644 wrote to memory of 4896 644 fqwofdtexigy.exe 158 PID 644 wrote to memory of 4896 644 fqwofdtexigy.exe 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe"C:\Users\Admin\AppData\Local\Temp\3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5100 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3256
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1908
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2988
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2552
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1492
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1812
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:1504
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:2224
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4468
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:1148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\3a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775cN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4720
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:892
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:916
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2660
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4624
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1772
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3388
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:864
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5e5629c2b0355884c7a022372c1a5e160
SHA1ba6c548fe73f1803797a8a93b6033ca4ba4af1eb
SHA2563a55dc16338ebbbd5310f50424dd9196d97ac5e4edc8e161476ea0b55de0775c
SHA512523f09776fa764bb1b9e1b6465aaa3e44a9be0dafc662db197b9578451c6620a28a7f9e286652fcf0514ff6b4eb8b5c2ebba263afe764e085db4b911bc1e5281
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82