Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe
Resource
win7-20240903-en
General
-
Target
a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe
-
Size
5.8MB
-
MD5
190e68a764f232fa236a23317f80892b
-
SHA1
a37b9e226334bc69abaacb539fb7ba9722831a76
-
SHA256
a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7
-
SHA512
34c5d7d35a639a2c6ea183ad808a10bc0adaebf806975f6949da119c1d90c50f065b3d238a0bd6b7159394fe39a0322590fe229cae73f7c9cc393e721449c0a2
-
SSDEEP
98304:ICAKtK2disEKWIAN9rDUQ60m+E+3syUSIkJEhxfAF8p4ucmEyVHNJdNOD5A:I7ObErIYeQ3nEIsyU2Y48CeHxNV
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/3164-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3164-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3164-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3164-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3164-75-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3164-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3164-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3164-76-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3164-77-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4636 powershell.exe 5036 powershell.exe -
Creates new service(s) 2 TTPs
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\hosts a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe File created C:\Windows\system32\drivers\etc\hosts Updater.exe -
Executes dropped EXE 1 IoCs
pid Process 4508 Updater.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 31 pastebin.com 30 pastebin.com -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4908 powercfg.exe 3864 powercfg.exe 2584 powercfg.exe 804 powercfg.exe 4248 powercfg.exe 5116 powercfg.exe 4980 powercfg.exe 4392 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe Updater.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4508 set thread context of 916 4508 Updater.exe 147 PID 4508 set thread context of 3164 4508 Updater.exe 151 -
resource yara_rule behavioral2/memory/3164-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-75-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-76-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3164-77-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1640 sc.exe 4932 sc.exe 2136 sc.exe 3604 sc.exe 5068 sc.exe 4696 sc.exe 5040 sc.exe 4092 sc.exe 2972 sc.exe 4116 sc.exe 1048 sc.exe 4876 sc.exe 2996 sc.exe 4800 sc.exe -
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 4636 powershell.exe 4636 powershell.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 3260 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe 4508 Updater.exe 5036 powershell.exe 5036 powershell.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 4508 Updater.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4636 powershell.exe Token: SeShutdownPrivilege 4392 powercfg.exe Token: SeCreatePagefilePrivilege 4392 powercfg.exe Token: SeShutdownPrivilege 3864 powercfg.exe Token: SeCreatePagefilePrivilege 3864 powercfg.exe Token: SeShutdownPrivilege 4908 powercfg.exe Token: SeCreatePagefilePrivilege 4908 powercfg.exe Token: SeShutdownPrivilege 2584 powercfg.exe Token: SeCreatePagefilePrivilege 2584 powercfg.exe Token: SeDebugPrivilege 5036 powershell.exe Token: SeShutdownPrivilege 4248 powercfg.exe Token: SeCreatePagefilePrivilege 4248 powercfg.exe Token: SeShutdownPrivilege 804 powercfg.exe Token: SeCreatePagefilePrivilege 804 powercfg.exe Token: SeShutdownPrivilege 4980 powercfg.exe Token: SeCreatePagefilePrivilege 4980 powercfg.exe Token: SeShutdownPrivilege 5116 powercfg.exe Token: SeCreatePagefilePrivilege 5116 powercfg.exe Token: SeLockMemoryPrivilege 3164 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4224 wrote to memory of 1292 4224 cmd.exe 102 PID 4224 wrote to memory of 1292 4224 cmd.exe 102 PID 4868 wrote to memory of 4500 4868 cmd.exe 136 PID 4868 wrote to memory of 4500 4868 cmd.exe 136 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 916 4508 Updater.exe 147 PID 4508 wrote to memory of 3164 4508 Updater.exe 151 PID 4508 wrote to memory of 3164 4508 Updater.exe 151 PID 4508 wrote to memory of 3164 4508 Updater.exe 151 PID 4508 wrote to memory of 3164 4508 Updater.exe 151 PID 4508 wrote to memory of 3164 4508 Updater.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe"C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3260 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1292
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4092
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4116
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2972
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:5068
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2996
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"2⤵
- Launches sc.exe
PID:4696
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"2⤵
- Launches sc.exe
PID:4800
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1640
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"2⤵
- Launches sc.exe
PID:5040
-
-
C:\ProgramData\GoogleUP\Chrome\Updater.exeC:\ProgramData\GoogleUP\Chrome\Updater.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4500
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4932
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1048
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2136
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4876
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3604
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:916
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5190e68a764f232fa236a23317f80892b
SHA1a37b9e226334bc69abaacb539fb7ba9722831a76
SHA256a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7
SHA51234c5d7d35a639a2c6ea183ad808a10bc0adaebf806975f6949da119c1d90c50f065b3d238a0bd6b7159394fe39a0322590fe229cae73f7c9cc393e721449c0a2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62