Analysis
-
max time kernel
120s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe
Resource
win7-20241023-en
General
-
Target
ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe
-
Size
5.6MB
-
MD5
70658e51f1df013fd7eeae4ee5b03ec0
-
SHA1
2c0ce8645a3662ff5f5bc1949b5847c54c5adea0
-
SHA256
ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786
-
SHA512
ec758b1992827c557c20bb532e8824a629ff9a40a8bd7c8f1b7d42f68806fbe68ded062f8a8462da0c768129fef546dd8df73c004e1c2fbd1b2a38ad55b1f5b8
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/1000-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1000-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3380 powershell.exe 4480 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 552 lutlgidagtja.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 3416 powercfg.exe 436 powercfg.exe 4208 powercfg.exe 804 powercfg.exe 932 powercfg.exe 716 powercfg.exe 1592 powercfg.exe 3348 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 552 set thread context of 2508 552 lutlgidagtja.exe 155 PID 552 set thread context of 1000 552 lutlgidagtja.exe 159 -
resource yara_rule behavioral2/memory/1000-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1000-74-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2408 sc.exe 4416 sc.exe 872 sc.exe 2456 sc.exe 3648 sc.exe 3572 sc.exe 3204 sc.exe 1064 sc.exe 1252 sc.exe 756 sc.exe 2528 sc.exe 1452 sc.exe 1392 sc.exe 3132 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 3380 powershell.exe 3380 powershell.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 2200 ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe 552 lutlgidagtja.exe 4480 powershell.exe 4480 powershell.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 552 lutlgidagtja.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe 1000 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3380 powershell.exe Token: SeShutdownPrivilege 3348 powercfg.exe Token: SeCreatePagefilePrivilege 3348 powercfg.exe Token: SeShutdownPrivilege 4208 powercfg.exe Token: SeCreatePagefilePrivilege 4208 powercfg.exe Token: SeShutdownPrivilege 3416 powercfg.exe Token: SeCreatePagefilePrivilege 3416 powercfg.exe Token: SeShutdownPrivilege 436 powercfg.exe Token: SeCreatePagefilePrivilege 436 powercfg.exe Token: SeDebugPrivilege 4480 powershell.exe Token: SeShutdownPrivilege 716 powercfg.exe Token: SeCreatePagefilePrivilege 716 powercfg.exe Token: SeShutdownPrivilege 932 powercfg.exe Token: SeCreatePagefilePrivilege 932 powercfg.exe Token: SeShutdownPrivilege 1592 powercfg.exe Token: SeCreatePagefilePrivilege 1592 powercfg.exe Token: SeShutdownPrivilege 804 powercfg.exe Token: SeCreatePagefilePrivilege 804 powercfg.exe Token: SeLockMemoryPrivilege 1000 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3216 wrote to memory of 1384 3216 cmd.exe 106 PID 3216 wrote to memory of 1384 3216 cmd.exe 106 PID 4620 wrote to memory of 4552 4620 cmd.exe 134 PID 4620 wrote to memory of 4552 4620 cmd.exe 134 PID 1344 wrote to memory of 4548 1344 cmd.exe 141 PID 1344 wrote to memory of 4548 1344 cmd.exe 141 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 2508 552 lutlgidagtja.exe 155 PID 552 wrote to memory of 1000 552 lutlgidagtja.exe 159 PID 552 wrote to memory of 1000 552 lutlgidagtja.exe 159 PID 552 wrote to memory of 1000 552 lutlgidagtja.exe 159 PID 552 wrote to memory of 1000 552 lutlgidagtja.exe 159 PID 552 wrote to memory of 1000 552 lutlgidagtja.exe 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe"C:\Users\Admin\AppData\Local\Temp\ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2200 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1384
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2456
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3648
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2408
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2528
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3572
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:4416
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:3204
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1252
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:1064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4552
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4548
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1452
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:756
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:872
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1392
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3132
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2508
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD570658e51f1df013fd7eeae4ee5b03ec0
SHA12c0ce8645a3662ff5f5bc1949b5847c54c5adea0
SHA256ae9e7366048425d616f9f5102c37a3c9c8ad73e14215be7982fac2050d321786
SHA512ec758b1992827c557c20bb532e8824a629ff9a40a8bd7c8f1b7d42f68806fbe68ded062f8a8462da0c768129fef546dd8df73c004e1c2fbd1b2a38ad55b1f5b8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82