Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe
Resource
win7-20241010-en
General
-
Target
e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe
-
Size
5.6MB
-
MD5
7783428c405057f004c150c584b28fa0
-
SHA1
eb166b4862e0892245acd4ce540c0699c3deb219
-
SHA256
e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686b
-
SHA512
c8a0f407e68ac0dda32f831a6a004caaa923ba94c1372037006172e836c92ef5cfbab5dc6ff8c56ec17bda3213ac8a2d5e4ecdc4fe749c35b84e69eed05a8462
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/2936-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2936-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4536 powershell.exe 1668 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 4344 lutlgidagtja.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4700 powercfg.exe 5080 powercfg.exe 2680 powercfg.exe 4016 powercfg.exe 4572 powercfg.exe 4180 powercfg.exe 2856 powercfg.exe 1372 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe File opened for modification C:\Windows\system32\MRT.exe e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4344 set thread context of 2940 4344 lutlgidagtja.exe 153 PID 4344 set thread context of 2936 4344 lutlgidagtja.exe 155 -
resource yara_rule behavioral2/memory/2936-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2936-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4056 sc.exe 1868 sc.exe 5096 sc.exe 4656 sc.exe 1148 sc.exe 4364 sc.exe 2952 sc.exe 2808 sc.exe 3840 sc.exe 1876 sc.exe 4452 sc.exe 4040 sc.exe 3032 sc.exe 1936 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 4536 powershell.exe 4536 powershell.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 2220 e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe 4344 lutlgidagtja.exe 1668 powershell.exe 1668 powershell.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 4344 lutlgidagtja.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe 2936 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4536 powershell.exe Token: SeShutdownPrivilege 4700 powercfg.exe Token: SeCreatePagefilePrivilege 4700 powercfg.exe Token: SeShutdownPrivilege 2680 powercfg.exe Token: SeCreatePagefilePrivilege 2680 powercfg.exe Token: SeShutdownPrivilege 5080 powercfg.exe Token: SeCreatePagefilePrivilege 5080 powercfg.exe Token: SeShutdownPrivilege 4016 powercfg.exe Token: SeCreatePagefilePrivilege 4016 powercfg.exe Token: SeDebugPrivilege 1668 powershell.exe Token: SeLockMemoryPrivilege 2936 nslookup.exe Token: SeShutdownPrivilege 2856 powercfg.exe Token: SeCreatePagefilePrivilege 2856 powercfg.exe Token: SeShutdownPrivilege 1372 powercfg.exe Token: SeCreatePagefilePrivilege 1372 powercfg.exe Token: SeShutdownPrivilege 4180 powercfg.exe Token: SeCreatePagefilePrivilege 4180 powercfg.exe Token: SeShutdownPrivilege 4572 powercfg.exe Token: SeCreatePagefilePrivilege 4572 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 912 wrote to memory of 2044 912 cmd.exe 106 PID 912 wrote to memory of 2044 912 cmd.exe 106 PID 4440 wrote to memory of 2308 4440 cmd.exe 132 PID 4440 wrote to memory of 2308 4440 cmd.exe 132 PID 3496 wrote to memory of 3776 3496 cmd.exe 142 PID 3496 wrote to memory of 3776 3496 cmd.exe 142 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2940 4344 lutlgidagtja.exe 153 PID 4344 wrote to memory of 2936 4344 lutlgidagtja.exe 155 PID 4344 wrote to memory of 2936 4344 lutlgidagtja.exe 155 PID 4344 wrote to memory of 2936 4344 lutlgidagtja.exe 155 PID 4344 wrote to memory of 2936 4344 lutlgidagtja.exe 155 PID 4344 wrote to memory of 2936 4344 lutlgidagtja.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe"C:\Users\Admin\AppData\Local\Temp\e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2220 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2044
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1148
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4056
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3032
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4364
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:2952
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:1876
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4452
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:4040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686bN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2308
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3776
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:5096
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4656
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2808
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3840
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1936
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2940
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD57783428c405057f004c150c584b28fa0
SHA1eb166b4862e0892245acd4ce540c0699c3deb219
SHA256e0e300039fa4d8b8070909f8697cdf9424373f0f805ac7f6bb63d6465e46686b
SHA512c8a0f407e68ac0dda32f831a6a004caaa923ba94c1372037006172e836c92ef5cfbab5dc6ff8c56ec17bda3213ac8a2d5e4ecdc4fe749c35b84e69eed05a8462
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82