Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
58s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
25/12/2024, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral2
Sample
a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe
Resource
win11-20241007-en
General
-
Target
a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe
-
Size
2.8MB
-
MD5
952415cd3af41728ca26f5c45cf3c867
-
SHA1
a2fc5bd9e6367919ef896665d6ecefba89f41e7e
-
SHA256
04cde81ac938706771fa9fe936ee8f79fe7e0799730985190d045ecccbd72235
-
SHA512
b2f73f68ef85fbf54f6228092f1506c6321a8a8cc4c1b9ece1f482958c97ea88e41863313fecd66a52ddc1ae1ad30f9b1bbc98de728fbdb7ee924287e7e07d0c
-
SSDEEP
49152:tOD0G+o20Jl6qY0+tiAJ5/SAt8ZSeWuFJp5FYv6LWhxeK/YgM7UmjD:tOD0GvtnY0+tTzaAtbeWgneyLQx/yN
Malware Config
Extracted
redline
719770735
45.133.36.107:1912
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000700000004586f-4.dat family_redline behavioral1/memory/4044-29-0x0000000000830000-0x0000000000882000-memory.dmp family_redline -
Redline family
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/3212-97-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/3212-96-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/3212-102-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/3212-101-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/3212-99-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/3212-100-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/3212-103-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/3212-104-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/3212-105-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3004 powershell.exe 2780 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\Control Panel\International\Geo\Nation a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe -
Executes dropped EXE 3 IoCs
pid Process 4044 build.exe 116 VLCMediaPlayer.exe 4816 psmwzamfkpsj.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe VLCMediaPlayer.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe psmwzamfkpsj.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4816 set thread context of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 set thread context of 3212 4816 psmwzamfkpsj.exe 136 -
resource yara_rule behavioral1/memory/3212-93-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-97-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-96-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-102-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-101-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-99-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-100-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-95-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-94-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-92-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-91-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-103-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-104-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/3212-105-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1128 sc.exe 3352 sc.exe 1988 sc.exe 3840 sc.exe 2460 sc.exe 3100 sc.exe 2096 sc.exe 1648 sc.exe 3368 sc.exe 3304 sc.exe 3504 sc.exe 4212 sc.exe 3496 sc.exe 476 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 116 VLCMediaPlayer.exe 3004 powershell.exe 3004 powershell.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 116 VLCMediaPlayer.exe 4816 psmwzamfkpsj.exe 2780 powershell.exe 2780 powershell.exe 4816 psmwzamfkpsj.exe 4816 psmwzamfkpsj.exe 4816 psmwzamfkpsj.exe 4816 psmwzamfkpsj.exe 4816 psmwzamfkpsj.exe 4816 psmwzamfkpsj.exe 4816 psmwzamfkpsj.exe 4816 psmwzamfkpsj.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe 3212 explorer.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 3004 powershell.exe Token: SeIncreaseQuotaPrivilege 3004 powershell.exe Token: SeSecurityPrivilege 3004 powershell.exe Token: SeTakeOwnershipPrivilege 3004 powershell.exe Token: SeLoadDriverPrivilege 3004 powershell.exe Token: SeSystemProfilePrivilege 3004 powershell.exe Token: SeSystemtimePrivilege 3004 powershell.exe Token: SeProfSingleProcessPrivilege 3004 powershell.exe Token: SeIncBasePriorityPrivilege 3004 powershell.exe Token: SeCreatePagefilePrivilege 3004 powershell.exe Token: SeBackupPrivilege 3004 powershell.exe Token: SeRestorePrivilege 3004 powershell.exe Token: SeShutdownPrivilege 3004 powershell.exe Token: SeDebugPrivilege 3004 powershell.exe Token: SeSystemEnvironmentPrivilege 3004 powershell.exe Token: SeRemoteShutdownPrivilege 3004 powershell.exe Token: SeUndockPrivilege 3004 powershell.exe Token: SeManageVolumePrivilege 3004 powershell.exe Token: 33 3004 powershell.exe Token: 34 3004 powershell.exe Token: 35 3004 powershell.exe Token: 36 3004 powershell.exe Token: SeDebugPrivilege 2780 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2780 powershell.exe Token: SeIncreaseQuotaPrivilege 2780 powershell.exe Token: SeSecurityPrivilege 2780 powershell.exe Token: SeTakeOwnershipPrivilege 2780 powershell.exe Token: SeLoadDriverPrivilege 2780 powershell.exe Token: SeSystemtimePrivilege 2780 powershell.exe Token: SeBackupPrivilege 2780 powershell.exe Token: SeRestorePrivilege 2780 powershell.exe Token: SeShutdownPrivilege 2780 powershell.exe Token: SeSystemEnvironmentPrivilege 2780 powershell.exe Token: SeUndockPrivilege 2780 powershell.exe Token: SeManageVolumePrivilege 2780 powershell.exe Token: SeLockMemoryPrivilege 3212 explorer.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3504 wrote to memory of 4044 3504 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 84 PID 3504 wrote to memory of 4044 3504 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 84 PID 3504 wrote to memory of 4044 3504 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 84 PID 3504 wrote to memory of 116 3504 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 85 PID 3504 wrote to memory of 116 3504 a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe 85 PID 1324 wrote to memory of 2528 1324 cmd.exe 101 PID 1324 wrote to memory of 2528 1324 cmd.exe 101 PID 3016 wrote to memory of 3940 3016 cmd.exe 126 PID 3016 wrote to memory of 3940 3016 cmd.exe 126 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 1624 4816 psmwzamfkpsj.exe 135 PID 4816 wrote to memory of 3212 4816 psmwzamfkpsj.exe 136 PID 4816 wrote to memory of 3212 4816 psmwzamfkpsj.exe 136 PID 4816 wrote to memory of 3212 4816 psmwzamfkpsj.exe 136 PID 4816 wrote to memory of 3212 4816 psmwzamfkpsj.exe 136 PID 4816 wrote to memory of 3212 4816 psmwzamfkpsj.exe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe"C:\Users\Admin\AppData\Local\Temp\a2fc5bd9e6367919ef896665d6ecefba89f41e7e.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4044
-
-
C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe"C:\Users\Admin\AppData\Local\Temp\VLCMediaPlayer.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:116 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:2528
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:1648
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:3352
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:1988
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:3368
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:3100
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GOPRDESH"3⤵
- Launches sc.exe
PID:3304
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GOPRDESH" binpath= "C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe" start= "auto"3⤵
- Launches sc.exe
PID:2096
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:4212
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GOPRDESH"3⤵
- Launches sc.exe
PID:3840
-
-
-
C:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exeC:\ProgramData\olxeukorrrgc\psmwzamfkpsj.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3940
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2460
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:3496
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3504
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:476
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1128
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1624
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD51584ec9d49300648fb4787af01e581ad
SHA136382ee29663f9a72140eac36c006fbba8c23eaa
SHA25683aad4b727208a7611de04a56e6a7c98ae2d73fd3bd47cfa93ce862e4adbf151
SHA512fc8251e40448c1f9aee8f2fb2034e4bc94f9e1c4b01b0713459d01611f884dc7c151067e0fb610af0210748c06c7c898c05d6b2407b8462593a3aaee58da15ec
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
300KB
MD5bf064d1a23c92866bc1e60151f28e9cf
SHA105785c3d76875aa8840b331ae4f3dbd137e675f4
SHA256d362df4546a30c0a7aff8e4d6c27d44b4e8b7d6f0819d02782730de941bf749c
SHA5123085d460c41d350bbcdf9a18c8bd3034c723ebe2823671fefcdd3224fd7d93809e5ab74df9e053a3a91cc74e1e5f11e2d73e5b10a24d1c218fc0826f5bc17621