Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe
Resource
win7-20240903-en
General
-
Target
30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe
-
Size
5.6MB
-
MD5
f8694f6a3b022fa4d93649ecf8ee86d0
-
SHA1
dee47ed9d0e43c292248a6fdb7594e57b3e3c164
-
SHA256
30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9
-
SHA512
440dfd616dab73d7b64162ae5e31850e975d7dc5a95b2f5f39b6439ba0c81a7d75742bc18d88a9a05936a77363e2f42341b3fd3627db77a0587d55126f6cb860
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/2916-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2916-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5036 powershell.exe 1076 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2360 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4864 powercfg.exe 1716 powercfg.exe 1608 powercfg.exe 4684 powercfg.exe 2828 powercfg.exe 4848 powercfg.exe 696 powercfg.exe 4268 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe File opened for modification C:\Windows\system32\MRT.exe 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2360 set thread context of 2212 2360 fqwofdtexigy.exe 153 PID 2360 set thread context of 2916 2360 fqwofdtexigy.exe 157 -
resource yara_rule behavioral2/memory/2916-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2916-74-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4392 sc.exe 900 sc.exe 3040 sc.exe 3388 sc.exe 2816 sc.exe 3080 sc.exe 1028 sc.exe 4884 sc.exe 916 sc.exe 4112 sc.exe 4224 sc.exe 3480 sc.exe 2448 sc.exe 4180 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 5036 powershell.exe 5036 powershell.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 3764 30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe 2360 fqwofdtexigy.exe 1076 powershell.exe 1076 powershell.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2360 fqwofdtexigy.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe 2916 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 5036 powershell.exe Token: SeShutdownPrivilege 1716 powercfg.exe Token: SeCreatePagefilePrivilege 1716 powercfg.exe Token: SeShutdownPrivilege 4268 powercfg.exe Token: SeCreatePagefilePrivilege 4268 powercfg.exe Token: SeShutdownPrivilege 4864 powercfg.exe Token: SeCreatePagefilePrivilege 4864 powercfg.exe Token: SeShutdownPrivilege 696 powercfg.exe Token: SeCreatePagefilePrivilege 696 powercfg.exe Token: SeDebugPrivilege 1076 powershell.exe Token: SeShutdownPrivilege 1608 powercfg.exe Token: SeCreatePagefilePrivilege 1608 powercfg.exe Token: SeShutdownPrivilege 4684 powercfg.exe Token: SeCreatePagefilePrivilege 4684 powercfg.exe Token: SeShutdownPrivilege 2828 powercfg.exe Token: SeCreatePagefilePrivilege 2828 powercfg.exe Token: SeLockMemoryPrivilege 2916 nslookup.exe Token: SeShutdownPrivilege 4848 powercfg.exe Token: SeCreatePagefilePrivilege 4848 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 640 wrote to memory of 1080 640 cmd.exe 102 PID 640 wrote to memory of 1080 640 cmd.exe 102 PID 3364 wrote to memory of 816 3364 cmd.exe 131 PID 3364 wrote to memory of 816 3364 cmd.exe 131 PID 3648 wrote to memory of 1912 3648 cmd.exe 139 PID 3648 wrote to memory of 1912 3648 cmd.exe 139 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2212 2360 fqwofdtexigy.exe 153 PID 2360 wrote to memory of 2916 2360 fqwofdtexigy.exe 157 PID 2360 wrote to memory of 2916 2360 fqwofdtexigy.exe 157 PID 2360 wrote to memory of 2916 2360 fqwofdtexigy.exe 157 PID 2360 wrote to memory of 2916 2360 fqwofdtexigy.exe 157 PID 2360 wrote to memory of 2916 2360 fqwofdtexigy.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe"C:\Users\Admin\AppData\Local\Temp\30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3764 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1080
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4884
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:916
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3480
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4112
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3040
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:696
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:4392
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:900
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4224
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:2448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\30524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:816
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1912
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3388
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2816
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4180
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3080
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1028
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2212
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD5f8694f6a3b022fa4d93649ecf8ee86d0
SHA1dee47ed9d0e43c292248a6fdb7594e57b3e3c164
SHA25630524fefdfb30a279e73f4c108d8a89be605ed447a232902bdd1976892fed4b9
SHA512440dfd616dab73d7b64162ae5e31850e975d7dc5a95b2f5f39b6439ba0c81a7d75742bc18d88a9a05936a77363e2f42341b3fd3627db77a0587d55126f6cb860
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82