Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe
Resource
win7-20240903-en
General
-
Target
768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe
-
Size
5.6MB
-
MD5
5cab9cd0fa3005bef262e4671563f590
-
SHA1
237c4474ccae565928362d792d542833a5511f44
-
SHA256
768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6
-
SHA512
f328de8f32c0cb11ae0cdd60af2bb72cb2ad342a128e28c52dd53e603b5c6624bb5bcca71f895cd097fcae0489bdce985aa5ad604e7ceac31e10472b6ace7d4e
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/3292-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3292-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1464 powershell.exe 984 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2740 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4372 powercfg.exe 1392 powercfg.exe 4176 powercfg.exe 2432 powercfg.exe 4492 powercfg.exe 1804 powercfg.exe 1592 powercfg.exe 3060 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2740 set thread context of 1044 2740 fqwofdtexigy.exe 153 PID 2740 set thread context of 3292 2740 fqwofdtexigy.exe 154 -
resource yara_rule behavioral2/memory/3292-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3292-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3176 sc.exe 748 sc.exe 812 sc.exe 4012 sc.exe 924 sc.exe 4860 sc.exe 320 sc.exe 2988 sc.exe 636 sc.exe 3268 sc.exe 1196 sc.exe 972 sc.exe 1984 sc.exe 5104 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1464 powershell.exe 1464 powershell.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 1216 768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe 2740 fqwofdtexigy.exe 984 powershell.exe 984 powershell.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 2740 fqwofdtexigy.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe 3292 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 1464 powershell.exe Token: SeShutdownPrivilege 4176 powercfg.exe Token: SeCreatePagefilePrivilege 4176 powercfg.exe Token: SeShutdownPrivilege 4372 powercfg.exe Token: SeCreatePagefilePrivilege 4372 powercfg.exe Token: SeShutdownPrivilege 2432 powercfg.exe Token: SeCreatePagefilePrivilege 2432 powercfg.exe Token: SeShutdownPrivilege 1392 powercfg.exe Token: SeCreatePagefilePrivilege 1392 powercfg.exe Token: SeDebugPrivilege 984 powershell.exe Token: SeShutdownPrivilege 1804 powercfg.exe Token: SeCreatePagefilePrivilege 1804 powercfg.exe Token: SeLockMemoryPrivilege 3292 nslookup.exe Token: SeShutdownPrivilege 4492 powercfg.exe Token: SeCreatePagefilePrivilege 4492 powercfg.exe Token: SeShutdownPrivilege 1592 powercfg.exe Token: SeCreatePagefilePrivilege 1592 powercfg.exe Token: SeShutdownPrivilege 3060 powercfg.exe Token: SeCreatePagefilePrivilege 3060 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 956 wrote to memory of 2684 956 cmd.exe 104 PID 956 wrote to memory of 2684 956 cmd.exe 104 PID 1936 wrote to memory of 4008 1936 cmd.exe 132 PID 1936 wrote to memory of 4008 1936 cmd.exe 132 PID 2820 wrote to memory of 3468 2820 cmd.exe 141 PID 2820 wrote to memory of 3468 2820 cmd.exe 141 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 1044 2740 fqwofdtexigy.exe 153 PID 2740 wrote to memory of 3292 2740 fqwofdtexigy.exe 154 PID 2740 wrote to memory of 3292 2740 fqwofdtexigy.exe 154 PID 2740 wrote to memory of 3292 2740 fqwofdtexigy.exe 154 PID 2740 wrote to memory of 3292 2740 fqwofdtexigy.exe 154 PID 2740 wrote to memory of 3292 2740 fqwofdtexigy.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe"C:\Users\Admin\AppData\Local\Temp\768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1216 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2684
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4012
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1984
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:924
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3268
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:5104
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:748
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:1196
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:972
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4008
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3468
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4860
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3176
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:320
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2988
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:636
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1044
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD55cab9cd0fa3005bef262e4671563f590
SHA1237c4474ccae565928362d792d542833a5511f44
SHA256768fb8d862b56fcfcf8f9a9c8caa311210e733548918e787b95bff3db9ea0ef6
SHA512f328de8f32c0cb11ae0cdd60af2bb72cb2ad342a128e28c52dd53e603b5c6624bb5bcca71f895cd097fcae0489bdce985aa5ad604e7ceac31e10472b6ace7d4e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82