Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe
Resource
win7-20240903-en
General
-
Target
7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe
-
Size
5.6MB
-
MD5
8da19ec93acd2d373d273cf9ce0a4030
-
SHA1
59334174f971e8eb10c74e069f14187300553c3c
-
SHA256
7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42
-
SHA512
f31ecb02f9d56b8dd01b38281c23a4c0c839b2a2b0711c8d0b440956991da6134190aee559f9ca7903e70a2bc36309e39e94a9e190f0a8e7e069014ab7691cee
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/920-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/920-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3820 powershell.exe 2824 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 1596 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 3488 powercfg.exe 528 powercfg.exe 3484 powercfg.exe 4320 powercfg.exe 4468 powercfg.exe 5052 powercfg.exe 2820 powercfg.exe 856 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe File opened for modification C:\Windows\system32\MRT.exe 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1596 set thread context of 4112 1596 fqwofdtexigy.exe 154 PID 1596 set thread context of 920 1596 fqwofdtexigy.exe 156 -
resource yara_rule behavioral2/memory/920-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/920-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3256 sc.exe 2936 sc.exe 1972 sc.exe 4536 sc.exe 3736 sc.exe 5016 sc.exe 4980 sc.exe 3496 sc.exe 3652 sc.exe 4124 sc.exe 3964 sc.exe 5068 sc.exe 3992 sc.exe 1704 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 3820 powershell.exe 3820 powershell.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 2888 7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe 1596 fqwofdtexigy.exe 2824 powershell.exe 2824 powershell.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 1596 fqwofdtexigy.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe 920 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3820 powershell.exe Token: SeShutdownPrivilege 4468 powercfg.exe Token: SeCreatePagefilePrivilege 4468 powercfg.exe Token: SeShutdownPrivilege 5052 powercfg.exe Token: SeCreatePagefilePrivilege 5052 powercfg.exe Token: SeShutdownPrivilege 4320 powercfg.exe Token: SeCreatePagefilePrivilege 4320 powercfg.exe Token: SeShutdownPrivilege 2820 powercfg.exe Token: SeCreatePagefilePrivilege 2820 powercfg.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeLockMemoryPrivilege 920 nslookup.exe Token: SeShutdownPrivilege 3488 powercfg.exe Token: SeCreatePagefilePrivilege 3488 powercfg.exe Token: SeShutdownPrivilege 856 powercfg.exe Token: SeCreatePagefilePrivilege 856 powercfg.exe Token: SeShutdownPrivilege 528 powercfg.exe Token: SeCreatePagefilePrivilege 528 powercfg.exe Token: SeShutdownPrivilege 3484 powercfg.exe Token: SeCreatePagefilePrivilege 3484 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1640 wrote to memory of 3968 1640 cmd.exe 107 PID 1640 wrote to memory of 3968 1640 cmd.exe 107 PID 1632 wrote to memory of 1316 1632 cmd.exe 133 PID 1632 wrote to memory of 1316 1632 cmd.exe 133 PID 4904 wrote to memory of 2932 4904 cmd.exe 141 PID 4904 wrote to memory of 2932 4904 cmd.exe 141 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 4112 1596 fqwofdtexigy.exe 154 PID 1596 wrote to memory of 920 1596 fqwofdtexigy.exe 156 PID 1596 wrote to memory of 920 1596 fqwofdtexigy.exe 156 PID 1596 wrote to memory of 920 1596 fqwofdtexigy.exe 156 PID 1596 wrote to memory of 920 1596 fqwofdtexigy.exe 156 PID 1596 wrote to memory of 920 1596 fqwofdtexigy.exe 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe"C:\Users\Admin\AppData\Local\Temp\7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2888 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3968
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1972
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4980
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3992
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4536
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3964
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:1704
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:5068
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:3496
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:3736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\7079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1316
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2932
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3256
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:5016
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2936
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3652
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4124
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:528
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4112
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD58da19ec93acd2d373d273cf9ce0a4030
SHA159334174f971e8eb10c74e069f14187300553c3c
SHA2567079cefffee8949efb52c966b8772c96bb0c0b3c555ed8533460ebaa69e55f42
SHA512f31ecb02f9d56b8dd01b38281c23a4c0c839b2a2b0711c8d0b440956991da6134190aee559f9ca7903e70a2bc36309e39e94a9e190f0a8e7e069014ab7691cee
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82