Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 17:57
Static task
static1
Behavioral task
behavioral1
Sample
TEst2.exe
Resource
win7-20241023-en
General
-
Target
TEst2.exe
-
Size
5.2MB
-
MD5
0944900665d80daea35877425ea31206
-
SHA1
d5b4ebe23d8d0457de2c82ef1a637b253349fb50
-
SHA256
4597d3959f9503aae779f95e81bf32b3d7b9d5faca9ee0f741c6bb3b7fa40b74
-
SHA512
c5dd8c5b3adca98eedf0fc048722c3bc9a60850321fd1eb95ad0c26daaa664ee20fcb0dec7ae73d4abfd1ad85e63baf2068acd6d027b2cac67eb9507edfa275d
-
SSDEEP
98304:CSYl+O1E/Uo8EoT9AfvDm+CIUzwNhiDbY1UaV/:CS7Uo/bfyhIUziUbIU+
Malware Config
Extracted
lumma
https://processhol.sbs/api
https://p10tgrace.sbs/api
https://peepburry828.sbs/api
https://3xp3cts1aim.sbs/api
https://p3ar11fter.sbs/api
Signatures
-
Lumma family
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/2892-112-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/2892-119-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/2892-123-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/2892-122-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/2892-121-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/2892-120-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/2892-111-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/2892-124-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/2892-125-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3684 powershell.exe 1504 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 4 IoCs
pid Process 2812 WeMod.exe 452 Sirus.exe 4780 Sirus.exe 1496 blvsiwuhlygz.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 428 powercfg.exe 2172 powercfg.exe 2064 powercfg.exe 3268 powercfg.exe 4480 powercfg.exe 3092 powercfg.exe 2608 powercfg.exe 4188 powercfg.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe blvsiwuhlygz.exe File opened for modification C:\Windows\system32\MRT.exe WeMod.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439} blvsiwuhlygz.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439}\1496.obs blvsiwuhlygz.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2812 WeMod.exe 1496 blvsiwuhlygz.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 452 set thread context of 4780 452 Sirus.exe 95 PID 1496 set thread context of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 set thread context of 2892 1496 blvsiwuhlygz.exe 159 -
resource yara_rule behavioral2/memory/2892-112-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-119-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-123-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-122-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-121-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-120-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-109-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-105-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-111-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-110-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-108-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-106-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-124-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/2892-125-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2892 sc.exe 2580 sc.exe 2860 sc.exe 2076 sc.exe 2948 sc.exe 4804 sc.exe 3376 sc.exe 4328 sc.exe 3856 sc.exe 2976 sc.exe 5092 sc.exe 2720 sc.exe 2864 sc.exe 4568 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2616 452 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEst2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sirus.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 3684 powershell.exe 3684 powershell.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 2812 WeMod.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1504 powershell.exe 1504 powershell.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 1496 blvsiwuhlygz.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe 2892 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3684 powershell.exe Token: SeShutdownPrivilege 3268 powercfg.exe Token: SeCreatePagefilePrivilege 3268 powercfg.exe Token: SeShutdownPrivilege 3092 powercfg.exe Token: SeCreatePagefilePrivilege 3092 powercfg.exe Token: SeShutdownPrivilege 4480 powercfg.exe Token: SeCreatePagefilePrivilege 4480 powercfg.exe Token: SeShutdownPrivilege 2608 powercfg.exe Token: SeCreatePagefilePrivilege 2608 powercfg.exe Token: SeDebugPrivilege 1504 powershell.exe Token: SeShutdownPrivilege 4188 powercfg.exe Token: SeCreatePagefilePrivilege 4188 powercfg.exe Token: SeShutdownPrivilege 428 powercfg.exe Token: SeCreatePagefilePrivilege 428 powercfg.exe Token: SeShutdownPrivilege 2064 powercfg.exe Token: SeCreatePagefilePrivilege 2064 powercfg.exe Token: SeShutdownPrivilege 2172 powercfg.exe Token: SeCreatePagefilePrivilege 2172 powercfg.exe Token: SeLockMemoryPrivilege 2892 explorer.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 404 wrote to memory of 2812 404 TEst2.exe 89 PID 404 wrote to memory of 2812 404 TEst2.exe 89 PID 404 wrote to memory of 452 404 TEst2.exe 93 PID 404 wrote to memory of 452 404 TEst2.exe 93 PID 404 wrote to memory of 452 404 TEst2.exe 93 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 452 wrote to memory of 4780 452 Sirus.exe 95 PID 2420 wrote to memory of 3400 2420 cmd.exe 105 PID 2420 wrote to memory of 3400 2420 cmd.exe 105 PID 5056 wrote to memory of 2272 5056 cmd.exe 133 PID 5056 wrote to memory of 2272 5056 cmd.exe 133 PID 1020 wrote to memory of 4984 1020 cmd.exe 144 PID 1020 wrote to memory of 4984 1020 cmd.exe 144 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 5052 1496 blvsiwuhlygz.exe 156 PID 1496 wrote to memory of 2892 1496 blvsiwuhlygz.exe 159 PID 1496 wrote to memory of 2892 1496 blvsiwuhlygz.exe 159 PID 1496 wrote to memory of 2892 1496 blvsiwuhlygz.exe 159 PID 1496 wrote to memory of 2892 1496 blvsiwuhlygz.exe 159 PID 1496 wrote to memory of 2892 1496 blvsiwuhlygz.exe 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\TEst2.exe"C:\Users\Admin\AppData\Local\Temp\TEst2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Roaming\WeMod.exeC:\Users\Admin\AppData\Roaming\WeMod.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:3400
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:2076
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4328
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:3856
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:2892
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:2580
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3092
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WHAMNXEF"3⤵
- Launches sc.exe
PID:2864
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WHAMNXEF" binpath= "C:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exe" start= "auto"3⤵
- Launches sc.exe
PID:2976
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:4568
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WHAMNXEF"3⤵
- Launches sc.exe
PID:2860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WeMod.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2272
-
-
-
-
C:\Users\Admin\AppData\Roaming\Sirus.exeC:\Users\Admin\AppData\Roaming\Sirus.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Roaming\Sirus.exe"C:\Users\Admin\AppData\Roaming\Sirus.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 2403⤵
- Program crash
PID:2616
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 452 -ip 4521⤵PID:2800
-
C:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exeC:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4984
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:5092
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2720
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2948
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3376
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4804
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4188
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:428
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:5052
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82