Analysis
-
max time kernel
119s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe
Resource
win7-20240903-en
General
-
Target
f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe
-
Size
5.5MB
-
MD5
88d4f016499352c4c85a23f2a4bfd990
-
SHA1
b8644cefd7655ff33792628373921a219b913cbd
-
SHA256
f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094
-
SHA512
92ffaa7cd9a0c7ce831d0b99b43a4b0507a5dfbd65aa0357c6129fc1cfeaf0493bdfb626d2637b1a747e22e300cbbd8d0e268ea22b41726d601e26714720a3fc
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/3480-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3480-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2836 powershell.exe 3912 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 4640 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4500 powercfg.exe 4788 powercfg.exe 4764 powercfg.exe 4348 powercfg.exe 316 powercfg.exe 2976 powercfg.exe 2716 powercfg.exe 4696 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4640 set thread context of 4736 4640 fqwofdtexigy.exe 152 PID 4640 set thread context of 3480 4640 fqwofdtexigy.exe 157 -
resource yara_rule behavioral2/memory/3480-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3480-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3504 sc.exe 2528 sc.exe 2652 sc.exe 1076 sc.exe 4944 sc.exe 4440 sc.exe 4904 sc.exe 4452 sc.exe 1836 sc.exe 2584 sc.exe 816 sc.exe 888 sc.exe 3472 sc.exe 2216 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2836 powershell.exe 2836 powershell.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 2752 f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe 4640 fqwofdtexigy.exe 3912 powershell.exe 3912 powershell.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 4640 fqwofdtexigy.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe 3480 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 2836 powershell.exe Token: SeShutdownPrivilege 4696 powercfg.exe Token: SeCreatePagefilePrivilege 4696 powercfg.exe Token: SeShutdownPrivilege 2716 powercfg.exe Token: SeCreatePagefilePrivilege 2716 powercfg.exe Token: SeShutdownPrivilege 4788 powercfg.exe Token: SeCreatePagefilePrivilege 4788 powercfg.exe Token: SeShutdownPrivilege 4500 powercfg.exe Token: SeCreatePagefilePrivilege 4500 powercfg.exe Token: SeDebugPrivilege 3912 powershell.exe Token: SeShutdownPrivilege 4348 powercfg.exe Token: SeCreatePagefilePrivilege 4348 powercfg.exe Token: SeShutdownPrivilege 316 powercfg.exe Token: SeCreatePagefilePrivilege 316 powercfg.exe Token: SeShutdownPrivilege 2976 powercfg.exe Token: SeCreatePagefilePrivilege 2976 powercfg.exe Token: SeShutdownPrivilege 4764 powercfg.exe Token: SeCreatePagefilePrivilege 4764 powercfg.exe Token: SeLockMemoryPrivilege 3480 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1468 wrote to memory of 2628 1468 cmd.exe 106 PID 1468 wrote to memory of 2628 1468 cmd.exe 106 PID 3524 wrote to memory of 3668 3524 cmd.exe 132 PID 3524 wrote to memory of 3668 3524 cmd.exe 132 PID 8 wrote to memory of 2056 8 cmd.exe 141 PID 8 wrote to memory of 2056 8 cmd.exe 141 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 4736 4640 fqwofdtexigy.exe 152 PID 4640 wrote to memory of 3480 4640 fqwofdtexigy.exe 157 PID 4640 wrote to memory of 3480 4640 fqwofdtexigy.exe 157 PID 4640 wrote to memory of 3480 4640 fqwofdtexigy.exe 157 PID 4640 wrote to memory of 3480 4640 fqwofdtexigy.exe 157 PID 4640 wrote to memory of 3480 4640 fqwofdtexigy.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe"C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2752 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2628
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4944
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3472
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1836
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2584
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:816
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:2216
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:2652
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4440
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:4904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3668
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2056
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1076
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:888
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3504
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2528
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4452
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4736
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD588d4f016499352c4c85a23f2a4bfd990
SHA1b8644cefd7655ff33792628373921a219b913cbd
SHA256f751a533c9b74e296086f726155e0b4b5b4b339e771318b0abe6255ddba04094
SHA51292ffaa7cd9a0c7ce831d0b99b43a4b0507a5dfbd65aa0357c6129fc1cfeaf0493bdfb626d2637b1a747e22e300cbbd8d0e268ea22b41726d601e26714720a3fc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82