Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 05:03
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
8.3MB
-
MD5
66039c9e643542b612ee5b216900c910
-
SHA1
3af08524281635f64e17f89838c6e528da7d723c
-
SHA256
35c6740a3fb5e35fc261d619abd34c2aaaa761096e36bb03515b536998bc1144
-
SHA512
220901ea547e2200700059944209958b929f237d58f6275fcca3ec27352766e002674202611f1f850074eb4b8bbe0b97797fd170265d9446f54a50bfbe0f79a0
-
SSDEEP
196608:ZBH5dgA2rBsUPeOOsmgGZ6SO7gTTYFaklmZChu+5pz:zEAIeOOsmguLtTd8hb5pz
Malware Config
Signatures
-
Xmrig family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe -
XMRig Miner payload 18 IoCs
resource yara_rule behavioral2/memory/1716-72-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-74-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-78-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-79-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-77-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-88-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-86-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-87-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-85-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-81-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-75-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-76-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-73-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-89-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-90-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-92-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-93-0x0000000140000000-0x000000014082C000-memory.dmp xmrig behavioral2/memory/1716-94-0x0000000140000000-0x000000014082C000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 208 powershell.exe 4808 powershell.exe -
Creates new service(s) 2 TTPs
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\hosts file.exe File created C:\Windows\system32\drivers\etc\hosts updater.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion updater.exe -
Executes dropped EXE 1 IoCs
pid Process 4956 updater.exe -
resource yara_rule behavioral2/memory/2872-1-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp themida behavioral2/memory/2872-0-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp themida behavioral2/memory/2872-3-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp themida behavioral2/memory/2872-4-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp themida behavioral2/memory/2872-5-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp themida behavioral2/memory/2872-25-0x00007FF7EFA30000-0x00007FF7F09B1000-memory.dmp themida behavioral2/files/0x0007000000023c78-26.dat themida behavioral2/memory/4956-28-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp themida behavioral2/memory/4956-29-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp themida behavioral2/memory/4956-30-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp themida behavioral2/memory/4956-31-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp themida behavioral2/memory/4956-84-0x00007FF63F260000-0x00007FF6401E1000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA updater.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 3952 powercfg.exe 4932 powercfg.exe 1196 powercfg.exe 4324 powercfg.exe 1968 powercfg.exe 4416 powercfg.exe 928 powercfg.exe 4384 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe updater.exe File opened for modification C:\Windows\system32\MRT.exe file.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2872 file.exe 4956 updater.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4956 set thread context of 1380 4956 updater.exe 149 PID 4956 set thread context of 1716 4956 updater.exe 154 -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4752 sc.exe 1688 sc.exe 1232 sc.exe 3004 sc.exe 2428 sc.exe 4340 sc.exe 2960 sc.exe 844 sc.exe 1016 sc.exe 4284 sc.exe 3632 sc.exe 1748 sc.exe 2532 sc.exe 332 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2872 file.exe 4808 powershell.exe 4808 powershell.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 2872 file.exe 4956 updater.exe 208 powershell.exe 208 powershell.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 4956 updater.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe 1716 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4808 powershell.exe Token: SeShutdownPrivilege 928 powercfg.exe Token: SeShutdownPrivilege 4932 powercfg.exe Token: SeCreatePagefilePrivilege 928 powercfg.exe Token: SeCreatePagefilePrivilege 4932 powercfg.exe Token: SeShutdownPrivilege 3952 powercfg.exe Token: SeCreatePagefilePrivilege 3952 powercfg.exe Token: SeShutdownPrivilege 4384 powercfg.exe Token: SeCreatePagefilePrivilege 4384 powercfg.exe Token: SeDebugPrivilege 208 powershell.exe Token: SeShutdownPrivilege 4416 powercfg.exe Token: SeCreatePagefilePrivilege 4416 powercfg.exe Token: SeShutdownPrivilege 4324 powercfg.exe Token: SeCreatePagefilePrivilege 4324 powercfg.exe Token: SeShutdownPrivilege 1196 powercfg.exe Token: SeCreatePagefilePrivilege 1196 powercfg.exe Token: SeShutdownPrivilege 1968 powercfg.exe Token: SeCreatePagefilePrivilege 1968 powercfg.exe Token: SeLockMemoryPrivilege 1716 explorer.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3544 wrote to memory of 4116 3544 cmd.exe 104 PID 3544 wrote to memory of 4116 3544 cmd.exe 104 PID 3152 wrote to memory of 3052 3152 cmd.exe 136 PID 3152 wrote to memory of 3052 3152 cmd.exe 136 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1380 4956 updater.exe 149 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154 PID 4956 wrote to memory of 1716 4956 updater.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2872 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4116
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1232
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:844
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1016
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4340
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4752
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"2⤵
- Launches sc.exe
PID:4284
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"2⤵
- Launches sc.exe
PID:3632
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1748
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"2⤵
- Launches sc.exe
PID:3004
-
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3052
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2532
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2960
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:332
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2428
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1688
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1380
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.3MB
MD566039c9e643542b612ee5b216900c910
SHA13af08524281635f64e17f89838c6e528da7d723c
SHA25635c6740a3fb5e35fc261d619abd34c2aaaa761096e36bb03515b536998bc1144
SHA512220901ea547e2200700059944209958b929f237d58f6275fcca3ec27352766e002674202611f1f850074eb4b8bbe0b97797fd170265d9446f54a50bfbe0f79a0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62