Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe
Resource
win7-20240708-en
General
-
Target
3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe
-
Size
5.6MB
-
MD5
4e2ef4bfc6a55ccb054bb240e632570f
-
SHA1
1ac57193892d7f5c89023ec5055fbdc002b6d7c0
-
SHA256
3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e
-
SHA512
c67f28da9586cb96957bdd432786b57630baae2329b989b491c6a77d7bc205fcc1ee3a234823a1eaac0c9a600cddc6725d0ba9fcf50656e9e4ca54c162b4cd4f
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hv:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgL
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/5104-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/5104-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1032 powershell.exe 3300 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 3316 fqwofdtexigy.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 3964 powercfg.exe 4820 powercfg.exe 2612 powercfg.exe 3808 powercfg.exe 1288 powercfg.exe 456 powercfg.exe 2004 powercfg.exe 4316 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3316 set thread context of 4304 3316 fqwofdtexigy.exe 143 PID 3316 set thread context of 5104 3316 fqwofdtexigy.exe 148 -
resource yara_rule behavioral2/memory/5104-55-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/5104-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2616 sc.exe 2856 sc.exe 3240 sc.exe 1208 sc.exe 3040 sc.exe 3680 sc.exe 216 sc.exe 644 sc.exe 4540 sc.exe 956 sc.exe 4920 sc.exe 3052 sc.exe 2912 sc.exe 4832 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 1032 powershell.exe 1032 powershell.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3532 3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe 3316 fqwofdtexigy.exe 3300 powershell.exe 3300 powershell.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 3316 fqwofdtexigy.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe 5104 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1032 powershell.exe Token: SeShutdownPrivilege 3964 powercfg.exe Token: SeCreatePagefilePrivilege 3964 powercfg.exe Token: SeShutdownPrivilege 4820 powercfg.exe Token: SeCreatePagefilePrivilege 4820 powercfg.exe Token: SeShutdownPrivilege 3808 powercfg.exe Token: SeCreatePagefilePrivilege 3808 powercfg.exe Token: SeShutdownPrivilege 2612 powercfg.exe Token: SeCreatePagefilePrivilege 2612 powercfg.exe Token: SeDebugPrivilege 3300 powershell.exe Token: SeShutdownPrivilege 456 powercfg.exe Token: SeCreatePagefilePrivilege 456 powercfg.exe Token: SeLockMemoryPrivilege 5104 nslookup.exe Token: SeShutdownPrivilege 4316 powercfg.exe Token: SeCreatePagefilePrivilege 4316 powercfg.exe Token: SeShutdownPrivilege 1288 powercfg.exe Token: SeCreatePagefilePrivilege 1288 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2876 wrote to memory of 888 2876 cmd.exe 97 PID 2876 wrote to memory of 888 2876 cmd.exe 97 PID 5092 wrote to memory of 460 5092 cmd.exe 122 PID 5092 wrote to memory of 460 5092 cmd.exe 122 PID 732 wrote to memory of 2920 732 cmd.exe 130 PID 732 wrote to memory of 2920 732 cmd.exe 130 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 4304 3316 fqwofdtexigy.exe 143 PID 3316 wrote to memory of 5104 3316 fqwofdtexigy.exe 148 PID 3316 wrote to memory of 5104 3316 fqwofdtexigy.exe 148 PID 3316 wrote to memory of 5104 3316 fqwofdtexigy.exe 148 PID 3316 wrote to memory of 5104 3316 fqwofdtexigy.exe 148 PID 3316 wrote to memory of 5104 3316 fqwofdtexigy.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe"C:\Users\Admin\AppData\Local\Temp\3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3532 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:888
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2616
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3240
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3052
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1208
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:644
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
PID:2856
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
PID:3040
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:3680
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
PID:4540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\3ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:460
-
-
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2920
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2912
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4832
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:216
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:956
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4920
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
PID:2004
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4304
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD54e2ef4bfc6a55ccb054bb240e632570f
SHA11ac57193892d7f5c89023ec5055fbdc002b6d7c0
SHA2563ec351ace473757905cc44f30695af1435985cdf0d3433381517b691235cc46e
SHA512c67f28da9586cb96957bdd432786b57630baae2329b989b491c6a77d7bc205fcc1ee3a234823a1eaac0c9a600cddc6725d0ba9fcf50656e9e4ca54c162b4cd4f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82