Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe
Resource
win7-20240903-en
General
-
Target
35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe
-
Size
5.5MB
-
MD5
b3b6b62ae29af73db4e5df1056f11070
-
SHA1
124fbab81268b69d9eaf7df696451ae4803bb14c
-
SHA256
35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7e
-
SHA512
0e1dea84ef54020e63211fbff782c66d181b5cff0291c3743f656a8efc20d9c53953ef14c4f36181f5655ab3358d9fdea25e79c77fae602b221c6624daccfafe
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/2692-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2692-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4136 powershell.exe 3384 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2872 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 408 powercfg.exe 4764 powercfg.exe 3164 powercfg.exe 2628 powercfg.exe 4324 powercfg.exe 4772 powercfg.exe 4956 powercfg.exe 1116 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2872 set thread context of 4044 2872 fqwofdtexigy.exe 151 PID 2872 set thread context of 2692 2872 fqwofdtexigy.exe 156 -
resource yara_rule behavioral2/memory/2692-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2692-72-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1680 sc.exe 3904 sc.exe 2352 sc.exe 2932 sc.exe 644 sc.exe 2888 sc.exe 1408 sc.exe 4836 sc.exe 2860 sc.exe 3760 sc.exe 3292 sc.exe 2328 sc.exe 2168 sc.exe 2520 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 3384 powershell.exe 3384 powershell.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 1704 35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe 2872 fqwofdtexigy.exe 4136 powershell.exe 4136 powershell.exe 4136 powershell.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2872 fqwofdtexigy.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe 2692 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3384 powershell.exe Token: SeShutdownPrivilege 4764 powercfg.exe Token: SeCreatePagefilePrivilege 4764 powercfg.exe Token: SeShutdownPrivilege 3164 powercfg.exe Token: SeCreatePagefilePrivilege 3164 powercfg.exe Token: SeShutdownPrivilege 4324 powercfg.exe Token: SeCreatePagefilePrivilege 4324 powercfg.exe Token: SeShutdownPrivilege 2628 powercfg.exe Token: SeCreatePagefilePrivilege 2628 powercfg.exe Token: SeDebugPrivilege 4136 powershell.exe Token: SeShutdownPrivilege 1116 powercfg.exe Token: SeCreatePagefilePrivilege 1116 powercfg.exe Token: SeShutdownPrivilege 408 powercfg.exe Token: SeCreatePagefilePrivilege 408 powercfg.exe Token: SeShutdownPrivilege 4956 powercfg.exe Token: SeCreatePagefilePrivilege 4956 powercfg.exe Token: SeShutdownPrivilege 4772 powercfg.exe Token: SeCreatePagefilePrivilege 4772 powercfg.exe Token: SeLockMemoryPrivilege 2692 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3376 wrote to memory of 1208 3376 cmd.exe 105 PID 3376 wrote to memory of 1208 3376 cmd.exe 105 PID 4812 wrote to memory of 4032 4812 cmd.exe 130 PID 4812 wrote to memory of 4032 4812 cmd.exe 130 PID 4220 wrote to memory of 2004 4220 cmd.exe 140 PID 4220 wrote to memory of 2004 4220 cmd.exe 140 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 4044 2872 fqwofdtexigy.exe 151 PID 2872 wrote to memory of 2692 2872 fqwofdtexigy.exe 156 PID 2872 wrote to memory of 2692 2872 fqwofdtexigy.exe 156 PID 2872 wrote to memory of 2692 2872 fqwofdtexigy.exe 156 PID 2872 wrote to memory of 2692 2872 fqwofdtexigy.exe 156 PID 2872 wrote to memory of 2692 2872 fqwofdtexigy.exe 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe"C:\Users\Admin\AppData\Local\Temp\35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1704 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1208
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3292
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1680
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3904
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4836
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2352
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:2328
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:2860
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2168
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:2932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\35ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7eN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4032
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2004
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:644
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2888
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2520
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3760
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1408
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4044
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5b3b6b62ae29af73db4e5df1056f11070
SHA1124fbab81268b69d9eaf7df696451ae4803bb14c
SHA25635ae31088cdc4ce3159934173b69fe2dd0ba1f6ca0a35286c87d2479fe636b7e
SHA5120e1dea84ef54020e63211fbff782c66d181b5cff0291c3743f656a8efc20d9c53953ef14c4f36181f5655ab3358d9fdea25e79c77fae602b221c6624daccfafe
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82