Overview
overview
10Static
static
10477abe4b25...51.exe
windows7-x64
10477abe4b25...51.exe
windows10-2004-x64
1047c6de91e1...b0.exe
windows7-x64
1047c6de91e1...b0.exe
windows10-2004-x64
1047ce70cdef...aa.exe
windows7-x64
1047ce70cdef...aa.exe
windows10-2004-x64
74809a98c25...ee.exe
windows7-x64
14809a98c25...ee.exe
windows10-2004-x64
10480bfd19cc...7e.exe
windows7-x64
10480bfd19cc...7e.exe
windows10-2004-x64
104818942b62...ae.exe
windows7-x64
104818942b62...ae.exe
windows10-2004-x64
10485ef3e4d3...15.exe
windows7-x64
10485ef3e4d3...15.exe
windows10-2004-x64
10486a44dd40...61.exe
windows7-x64
10486a44dd40...61.exe
windows10-2004-x64
10487afaa242...b4.exe
windows7-x64
3487afaa242...b4.exe
windows10-2004-x64
3488aec85d4...b2.exe
windows7-x64
8488aec85d4...b2.exe
windows10-2004-x64
848dd84f7a2...da.exe
windows7-x64
1048dd84f7a2...da.exe
windows10-2004-x64
104931b13a12...db.exe
windows7-x64
104931b13a12...db.exe
windows10-2004-x64
104963d3411f...95.exe
windows7-x64
34963d3411f...95.exe
windows10-2004-x64
34981b96b4a...e4.exe
windows7-x64
34981b96b4a...e4.exe
windows10-2004-x64
34996155e60...cb.exe
windows7-x64
104996155e60...cb.exe
windows10-2004-x64
1049986bd925...30.exe
windows7-x64
1049986bd925...30.exe
windows10-2004-x64
10Analysis
-
max time kernel
151s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:10
Behavioral task
behavioral1
Sample
477abe4b25790663f42286884bad1f54fccac4fd3c881cf1c7d7ad8d7bab3351.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
477abe4b25790663f42286884bad1f54fccac4fd3c881cf1c7d7ad8d7bab3351.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
47c6de91e1706234f4587aa8f42a8c76d818b3055dc457b6dda51b803bf09ab0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
47c6de91e1706234f4587aa8f42a8c76d818b3055dc457b6dda51b803bf09ab0.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
47ce70cdeffbe184e4414b64b813fcaa.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
47ce70cdeffbe184e4414b64b813fcaa.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
4809a98c25f0a7be709206691dd2a0ee.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
4809a98c25f0a7be709206691dd2a0ee.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
480bfd19cce007d5891ad838d903b17e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
480bfd19cce007d5891ad838d903b17e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
4818942b6268d474373eadf8aa175f0de0315fc406eafa97d7fa7db7c154e9ae.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
4818942b6268d474373eadf8aa175f0de0315fc406eafa97d7fa7db7c154e9ae.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
485ef3e4d31b39e6107f797859f14415.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
485ef3e4d31b39e6107f797859f14415.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
486a44dd40852eb23aeca8e8951ffa61.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
486a44dd40852eb23aeca8e8951ffa61.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
487afaa2421384f1449a96637df558b4.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
487afaa2421384f1449a96637df558b4.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
488aec85d490754bc445f0e21e7d4d5146c71d500bd953b8108608d44e0351b2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
488aec85d490754bc445f0e21e7d4d5146c71d500bd953b8108608d44e0351b2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
4931b13a1265c5602753b3933aeb20740855f573997799ae8aed85ca66d193db.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
4931b13a1265c5602753b3933aeb20740855f573997799ae8aed85ca66d193db.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
4963d3411f742a92635dbd83146f3f5f7abed444f92750bcdd14072efd30e695.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
4963d3411f742a92635dbd83146f3f5f7abed444f92750bcdd14072efd30e695.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
4981b96b4a936aa6e960d3d9604a63e4.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
4981b96b4a936aa6e960d3d9604a63e4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
4996155e60aac91174cee14de1120fcb.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
4996155e60aac91174cee14de1120fcb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
49986bd925df8b3a09e58c4999927830.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
49986bd925df8b3a09e58c4999927830.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
486a44dd40852eb23aeca8e8951ffa61.exe
-
Size
54KB
-
MD5
486a44dd40852eb23aeca8e8951ffa61
-
SHA1
6fb6f73727522c1b67cf7db5853bd12e84226753
-
SHA256
ce834e57992c0f4579135e3313b176f2493712eaa6b5fd96aecd972b297d4c92
-
SHA512
d37587fc39fdf91a180f9b8b3cfdda6e804e28e82630428ca73205f70641a84e700a8f3558a928b31f59ad25d77364322e7fd5c0a37814fa21b8bcca66d6d6d4
-
SSDEEP
768:VyJZuIZ2Eslt0g5Xy3N3+dJSNXxWQG35bmaePD5PvPtXXJdxIEpmBg:Vyr1Gt0g5+NaGhWQcGDfX3xIEpmBg
Malware Config
Signatures
-
Njrat family
-
Stops running service(s) 4 TTPs
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e5cf16c381d2c6f9bd898a2b029e870.exe 486a44dd40852eb23aeca8e8951ffa61.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e5cf16c381d2c6f9bd898a2b029e870.exe 486a44dd40852eb23aeca8e8951ffa61.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\5e5cf16c381d2c6f9bd898a2b029e870 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\486a44dd40852eb23aeca8e8951ffa61.exe\" .." 486a44dd40852eb23aeca8e8951ffa61.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5e5cf16c381d2c6f9bd898a2b029e870 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\486a44dd40852eb23aeca8e8951ffa61.exe\" .." 486a44dd40852eb23aeca8e8951ffa61.exe -
pid Process 2996 powershell.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2800 sc.exe 2612 sc.exe 2588 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486a44dd40852eb23aeca8e8951ffa61.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Kills process with taskkill 1 IoCs
pid Process 944 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe 2840 486a44dd40852eb23aeca8e8951ffa61.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2840 486a44dd40852eb23aeca8e8951ffa61.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeDebugPrivilege 2996 powershell.exe Token: SeDebugPrivilege 944 taskkill.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 2840 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 2840 486a44dd40852eb23aeca8e8951ffa61.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2952 2840 486a44dd40852eb23aeca8e8951ffa61.exe 29 PID 2840 wrote to memory of 2952 2840 486a44dd40852eb23aeca8e8951ffa61.exe 29 PID 2840 wrote to memory of 2952 2840 486a44dd40852eb23aeca8e8951ffa61.exe 29 PID 2840 wrote to memory of 2952 2840 486a44dd40852eb23aeca8e8951ffa61.exe 29 PID 2840 wrote to memory of 1824 2840 486a44dd40852eb23aeca8e8951ffa61.exe 31 PID 2840 wrote to memory of 1824 2840 486a44dd40852eb23aeca8e8951ffa61.exe 31 PID 2840 wrote to memory of 1824 2840 486a44dd40852eb23aeca8e8951ffa61.exe 31 PID 2840 wrote to memory of 1824 2840 486a44dd40852eb23aeca8e8951ffa61.exe 31 PID 1824 wrote to memory of 2996 1824 cmd.exe 33 PID 1824 wrote to memory of 2996 1824 cmd.exe 33 PID 1824 wrote to memory of 2996 1824 cmd.exe 33 PID 1824 wrote to memory of 2996 1824 cmd.exe 33 PID 2840 wrote to memory of 2884 2840 486a44dd40852eb23aeca8e8951ffa61.exe 34 PID 2840 wrote to memory of 2884 2840 486a44dd40852eb23aeca8e8951ffa61.exe 34 PID 2840 wrote to memory of 2884 2840 486a44dd40852eb23aeca8e8951ffa61.exe 34 PID 2840 wrote to memory of 2884 2840 486a44dd40852eb23aeca8e8951ffa61.exe 34 PID 2884 wrote to memory of 2588 2884 cmd.exe 36 PID 2884 wrote to memory of 2588 2884 cmd.exe 36 PID 2884 wrote to memory of 2588 2884 cmd.exe 36 PID 2884 wrote to memory of 2588 2884 cmd.exe 36 PID 2840 wrote to memory of 2752 2840 486a44dd40852eb23aeca8e8951ffa61.exe 37 PID 2840 wrote to memory of 2752 2840 486a44dd40852eb23aeca8e8951ffa61.exe 37 PID 2840 wrote to memory of 2752 2840 486a44dd40852eb23aeca8e8951ffa61.exe 37 PID 2840 wrote to memory of 2752 2840 486a44dd40852eb23aeca8e8951ffa61.exe 37 PID 2752 wrote to memory of 2800 2752 cmd.exe 39 PID 2752 wrote to memory of 2800 2752 cmd.exe 39 PID 2752 wrote to memory of 2800 2752 cmd.exe 39 PID 2752 wrote to memory of 2800 2752 cmd.exe 39 PID 2840 wrote to memory of 2824 2840 486a44dd40852eb23aeca8e8951ffa61.exe 40 PID 2840 wrote to memory of 2824 2840 486a44dd40852eb23aeca8e8951ffa61.exe 40 PID 2840 wrote to memory of 2824 2840 486a44dd40852eb23aeca8e8951ffa61.exe 40 PID 2840 wrote to memory of 2824 2840 486a44dd40852eb23aeca8e8951ffa61.exe 40 PID 2824 wrote to memory of 2612 2824 cmd.exe 42 PID 2824 wrote to memory of 2612 2824 cmd.exe 42 PID 2824 wrote to memory of 2612 2824 cmd.exe 42 PID 2824 wrote to memory of 2612 2824 cmd.exe 42 PID 2840 wrote to memory of 2256 2840 486a44dd40852eb23aeca8e8951ffa61.exe 43 PID 2840 wrote to memory of 2256 2840 486a44dd40852eb23aeca8e8951ffa61.exe 43 PID 2840 wrote to memory of 2256 2840 486a44dd40852eb23aeca8e8951ffa61.exe 43 PID 2840 wrote to memory of 2256 2840 486a44dd40852eb23aeca8e8951ffa61.exe 43 PID 2256 wrote to memory of 944 2256 cmd.exe 45 PID 2256 wrote to memory of 944 2256 cmd.exe 45 PID 2256 wrote to memory of 944 2256 cmd.exe 45 PID 2256 wrote to memory of 944 2256 cmd.exe 45 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2952 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\486a44dd40852eb23aeca8e8951ffa61.exe"C:\Users\Admin\AppData\Local\Temp\486a44dd40852eb23aeca8e8951ffa61.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\486a44dd40852eb23aeca8e8951ffa61.exe"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2952
-
-
C:\Windows\SysWOW64\cmd.execmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc query windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\sc.exesc query windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2588
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc stop windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\sc.exesc stop windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2800
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc delete windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\sc.exesc delete windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im Google.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Google.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1