Analysis
-
max time kernel
120s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 00:34
Static task
static1
Behavioral task
behavioral1
Sample
60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe
Resource
win7-20240903-en
General
-
Target
60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe
-
Size
5.6MB
-
MD5
d6d612ba9eccf2038916dd20143523d0
-
SHA1
61f5ccc8bc484f5564e061cd636b7aba7579350f
-
SHA256
60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303f
-
SHA512
6508c7cc6825f216581aa8f85e9028edd7f25033f9229682121d196e89acaa80c32cd09ca9dba4ffe4fc2532e7e7cdb539b22446cb221c3a8032b8a41be0f94b
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/1536-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1536-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3040 powershell.exe 4044 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 4000 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 3588 powercfg.exe 4676 powercfg.exe 5068 powercfg.exe 2484 powercfg.exe 2304 powercfg.exe 4804 powercfg.exe 1152 powercfg.exe 4176 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4000 set thread context of 3704 4000 fqwofdtexigy.exe 143 PID 4000 set thread context of 1536 4000 fqwofdtexigy.exe 146 -
resource yara_rule behavioral2/memory/1536-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1536-74-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5000 sc.exe 3852 sc.exe 3376 sc.exe 2684 sc.exe 4772 sc.exe 4972 sc.exe 4020 sc.exe 3604 sc.exe 1548 sc.exe 2344 sc.exe 624 sc.exe 2648 sc.exe 2436 sc.exe 3228 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 3040 powershell.exe 3040 powershell.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 920 60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe 4000 fqwofdtexigy.exe 4044 powershell.exe 4044 powershell.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 4000 fqwofdtexigy.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe 1536 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3040 powershell.exe Token: SeShutdownPrivilege 4676 powercfg.exe Token: SeCreatePagefilePrivilege 4676 powercfg.exe Token: SeShutdownPrivilege 2484 powercfg.exe Token: SeCreatePagefilePrivilege 2484 powercfg.exe Token: SeShutdownPrivilege 5068 powercfg.exe Token: SeCreatePagefilePrivilege 5068 powercfg.exe Token: SeShutdownPrivilege 3588 powercfg.exe Token: SeCreatePagefilePrivilege 3588 powercfg.exe Token: SeDebugPrivilege 4044 powershell.exe Token: SeShutdownPrivilege 2304 powercfg.exe Token: SeCreatePagefilePrivilege 2304 powercfg.exe Token: SeShutdownPrivilege 4804 powercfg.exe Token: SeCreatePagefilePrivilege 4804 powercfg.exe Token: SeShutdownPrivilege 1152 powercfg.exe Token: SeCreatePagefilePrivilege 1152 powercfg.exe Token: SeLockMemoryPrivilege 1536 nslookup.exe Token: SeShutdownPrivilege 4176 powercfg.exe Token: SeCreatePagefilePrivilege 4176 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2292 2184 cmd.exe 95 PID 2184 wrote to memory of 2292 2184 cmd.exe 95 PID 1060 wrote to memory of 8 1060 cmd.exe 123 PID 1060 wrote to memory of 8 1060 cmd.exe 123 PID 3864 wrote to memory of 4824 3864 cmd.exe 131 PID 3864 wrote to memory of 4824 3864 cmd.exe 131 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 3704 4000 fqwofdtexigy.exe 143 PID 4000 wrote to memory of 1536 4000 fqwofdtexigy.exe 146 PID 4000 wrote to memory of 1536 4000 fqwofdtexigy.exe 146 PID 4000 wrote to memory of 1536 4000 fqwofdtexigy.exe 146 PID 4000 wrote to memory of 1536 4000 fqwofdtexigy.exe 146 PID 4000 wrote to memory of 1536 4000 fqwofdtexigy.exe 146
Processes
-
C:\Users\Admin\AppData\Local\Temp\60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe"C:\Users\Admin\AppData\Local\Temp\60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:920 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2292
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:5000
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2684
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4772
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4020
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3604
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:624
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:4972
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2648
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:3852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\60a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303fN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:8
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4824
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2436
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3376
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3228
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2344
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1548
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:3704
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD5d6d612ba9eccf2038916dd20143523d0
SHA161f5ccc8bc484f5564e061cd636b7aba7579350f
SHA25660a2119602b2de74eb5ffd601b42821a39c5f6c910042d90fbedb2154780303f
SHA5126508c7cc6825f216581aa8f85e9028edd7f25033f9229682121d196e89acaa80c32cd09ca9dba4ffe4fc2532e7e7cdb539b22446cb221c3a8032b8a41be0f94b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82