Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe
Resource
win7-20240903-en
General
-
Target
0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe
-
Size
5.6MB
-
MD5
f8b1a168ffad863d4c4199d10d033591
-
SHA1
48a08f3d6b3ac212ba0f1642c3f46561fbfb4ac2
-
SHA256
0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1
-
SHA512
fb0fff80db4d4ab3f716190a524bce085d9bd135ddeaffc26bc63eb14f3917c4a8c27a0948b7b7c83de9ed82d6e9ff6e9006e3245d80a85782ceecfe4cd11770
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7i:xFKoU8O5/b2XViSjX310SeyGc7u7i
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/4132-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4132-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3264 powershell.exe 944 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 4436 lutlgidagtja.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 432 powercfg.exe 1180 powercfg.exe 732 powercfg.exe 3116 powercfg.exe 5060 powercfg.exe 808 powercfg.exe 3880 powercfg.exe 1256 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe File opened for modification C:\Windows\system32\MRT.exe 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4436 set thread context of 4388 4436 lutlgidagtja.exe 146 PID 4436 set thread context of 4132 4436 lutlgidagtja.exe 151 -
resource yara_rule behavioral2/memory/4132-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4132-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4324 sc.exe 4580 sc.exe 4916 sc.exe 4064 sc.exe 2896 sc.exe 3236 sc.exe 4452 sc.exe 3980 sc.exe 1912 sc.exe 336 sc.exe 4968 sc.exe 4676 sc.exe 4432 sc.exe 4144 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 3264 powershell.exe 3264 powershell.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 856 0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe 4436 lutlgidagtja.exe 944 powershell.exe 944 powershell.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4436 lutlgidagtja.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe 4132 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3264 powershell.exe Token: SeShutdownPrivilege 1256 powercfg.exe Token: SeCreatePagefilePrivilege 1256 powercfg.exe Token: SeShutdownPrivilege 432 powercfg.exe Token: SeCreatePagefilePrivilege 432 powercfg.exe Token: SeShutdownPrivilege 3880 powercfg.exe Token: SeCreatePagefilePrivilege 3880 powercfg.exe Token: SeShutdownPrivilege 1180 powercfg.exe Token: SeCreatePagefilePrivilege 1180 powercfg.exe Token: SeDebugPrivilege 944 powershell.exe Token: SeShutdownPrivilege 732 powercfg.exe Token: SeCreatePagefilePrivilege 732 powercfg.exe Token: SeShutdownPrivilege 3116 powercfg.exe Token: SeCreatePagefilePrivilege 3116 powercfg.exe Token: SeShutdownPrivilege 5060 powercfg.exe Token: SeCreatePagefilePrivilege 5060 powercfg.exe Token: SeShutdownPrivilege 808 powercfg.exe Token: SeCreatePagefilePrivilege 808 powercfg.exe Token: SeLockMemoryPrivilege 4132 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 5000 wrote to memory of 2676 5000 cmd.exe 100 PID 5000 wrote to memory of 2676 5000 cmd.exe 100 PID 4104 wrote to memory of 1296 4104 cmd.exe 125 PID 4104 wrote to memory of 1296 4104 cmd.exe 125 PID 828 wrote to memory of 3900 828 cmd.exe 133 PID 828 wrote to memory of 3900 828 cmd.exe 133 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4388 4436 lutlgidagtja.exe 146 PID 4436 wrote to memory of 4132 4436 lutlgidagtja.exe 151 PID 4436 wrote to memory of 4132 4436 lutlgidagtja.exe 151 PID 4436 wrote to memory of 4132 4436 lutlgidagtja.exe 151 PID 4436 wrote to memory of 4132 4436 lutlgidagtja.exe 151 PID 4436 wrote to memory of 4132 4436 lutlgidagtja.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe"C:\Users\Admin\AppData\Local\Temp\0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:856 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2676
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4916
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4144
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4324
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4968
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4676
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:3236
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:4432
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4452
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:4580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\0ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1296
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3900
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4064
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2896
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3980
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1912
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:336
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:732
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4388
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD5f8b1a168ffad863d4c4199d10d033591
SHA148a08f3d6b3ac212ba0f1642c3f46561fbfb4ac2
SHA2560ec18d05affbc058553c645632ad2da7262affb8d9b4bc306333b06f3c2b0ed1
SHA512fb0fff80db4d4ab3f716190a524bce085d9bd135ddeaffc26bc63eb14f3917c4a8c27a0948b7b7c83de9ed82d6e9ff6e9006e3245d80a85782ceecfe4cd11770
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82