Analysis
-
max time kernel
119s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 08:34
Static task
static1
Behavioral task
behavioral1
Sample
4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe
Resource
win7-20240903-en
General
-
Target
4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe
-
Size
5.6MB
-
MD5
2bd3a66d7d0cb47d90ee7107a8c80ac0
-
SHA1
e53b499eea45efc7965c08412c838555ab280aad
-
SHA256
4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9ba
-
SHA512
d71870806c41a9c514104951b563055b0d7f1d18129c988d2c5b0cf2b8df6892c13d368cc2663af7b9efc3ea73bde9ee5872f06483da535d7f39b8c94b91f6be
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/1876-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/1876-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3612 powershell.exe 4464 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 668 lutlgidagtja.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1448 powercfg.exe 1496 powercfg.exe 848 powercfg.exe 3840 powercfg.exe 2476 powercfg.exe 2844 powercfg.exe 3604 powercfg.exe 3812 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 668 set thread context of 4524 668 lutlgidagtja.exe 146 PID 668 set thread context of 1876 668 lutlgidagtja.exe 150 -
resource yara_rule behavioral2/memory/1876-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/1876-72-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2672 sc.exe 4024 sc.exe 2000 sc.exe 3984 sc.exe 3156 sc.exe 1864 sc.exe 3580 sc.exe 5020 sc.exe 4364 sc.exe 3216 sc.exe 3312 sc.exe 3332 sc.exe 1168 sc.exe 3844 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 3612 powershell.exe 3612 powershell.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 320 4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe 668 lutlgidagtja.exe 4464 powershell.exe 4464 powershell.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 668 lutlgidagtja.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe 1876 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 3612 powershell.exe Token: SeShutdownPrivilege 2476 powercfg.exe Token: SeCreatePagefilePrivilege 2476 powercfg.exe Token: SeShutdownPrivilege 2844 powercfg.exe Token: SeCreatePagefilePrivilege 2844 powercfg.exe Token: SeShutdownPrivilege 3812 powercfg.exe Token: SeCreatePagefilePrivilege 3812 powercfg.exe Token: SeShutdownPrivilege 3604 powercfg.exe Token: SeCreatePagefilePrivilege 3604 powercfg.exe Token: SeDebugPrivilege 4464 powershell.exe Token: SeShutdownPrivilege 3840 powercfg.exe Token: SeCreatePagefilePrivilege 3840 powercfg.exe Token: SeShutdownPrivilege 1496 powercfg.exe Token: SeCreatePagefilePrivilege 1496 powercfg.exe Token: SeShutdownPrivilege 848 powercfg.exe Token: SeCreatePagefilePrivilege 848 powercfg.exe Token: SeShutdownPrivilege 1448 powercfg.exe Token: SeCreatePagefilePrivilege 1448 powercfg.exe Token: SeLockMemoryPrivilege 1876 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1456 wrote to memory of 2256 1456 cmd.exe 100 PID 1456 wrote to memory of 2256 1456 cmd.exe 100 PID 1228 wrote to memory of 2408 1228 cmd.exe 125 PID 1228 wrote to memory of 2408 1228 cmd.exe 125 PID 2836 wrote to memory of 4440 2836 cmd.exe 133 PID 2836 wrote to memory of 4440 2836 cmd.exe 133 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 4524 668 lutlgidagtja.exe 146 PID 668 wrote to memory of 1876 668 lutlgidagtja.exe 150 PID 668 wrote to memory of 1876 668 lutlgidagtja.exe 150 PID 668 wrote to memory of 1876 668 lutlgidagtja.exe 150 PID 668 wrote to memory of 1876 668 lutlgidagtja.exe 150 PID 668 wrote to memory of 1876 668 lutlgidagtja.exe 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe"C:\Users\Admin\AppData\Local\Temp\4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:320 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2256
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2000
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:5020
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3984
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3216
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1168
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:3844
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:2672
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4364
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:3156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\4da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9baN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2408
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4440
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3312
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1864
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4024
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3580
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3332
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4524
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD52bd3a66d7d0cb47d90ee7107a8c80ac0
SHA1e53b499eea45efc7965c08412c838555ab280aad
SHA2564da76fac218ef73b5cb327ca725859857ebc9ca22ec1d678e6a782e8db95e9ba
SHA512d71870806c41a9c514104951b563055b0d7f1d18129c988d2c5b0cf2b8df6892c13d368cc2663af7b9efc3ea73bde9ee5872f06483da535d7f39b8c94b91f6be
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82