Overview
overview
10Static
static
10477abe4b25...51.exe
windows7-x64
10477abe4b25...51.exe
windows10-2004-x64
1047c6de91e1...b0.exe
windows7-x64
1047c6de91e1...b0.exe
windows10-2004-x64
1047ce70cdef...aa.exe
windows7-x64
1047ce70cdef...aa.exe
windows10-2004-x64
74809a98c25...ee.exe
windows7-x64
14809a98c25...ee.exe
windows10-2004-x64
10480bfd19cc...7e.exe
windows7-x64
10480bfd19cc...7e.exe
windows10-2004-x64
104818942b62...ae.exe
windows7-x64
104818942b62...ae.exe
windows10-2004-x64
10485ef3e4d3...15.exe
windows7-x64
10485ef3e4d3...15.exe
windows10-2004-x64
10486a44dd40...61.exe
windows7-x64
10486a44dd40...61.exe
windows10-2004-x64
10487afaa242...b4.exe
windows7-x64
3487afaa242...b4.exe
windows10-2004-x64
3488aec85d4...b2.exe
windows7-x64
8488aec85d4...b2.exe
windows10-2004-x64
848dd84f7a2...da.exe
windows7-x64
1048dd84f7a2...da.exe
windows10-2004-x64
104931b13a12...db.exe
windows7-x64
104931b13a12...db.exe
windows10-2004-x64
104963d3411f...95.exe
windows7-x64
34963d3411f...95.exe
windows10-2004-x64
34981b96b4a...e4.exe
windows7-x64
34981b96b4a...e4.exe
windows10-2004-x64
34996155e60...cb.exe
windows7-x64
104996155e60...cb.exe
windows10-2004-x64
1049986bd925...30.exe
windows7-x64
1049986bd925...30.exe
windows10-2004-x64
10Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:10
Behavioral task
behavioral1
Sample
477abe4b25790663f42286884bad1f54fccac4fd3c881cf1c7d7ad8d7bab3351.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
477abe4b25790663f42286884bad1f54fccac4fd3c881cf1c7d7ad8d7bab3351.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
47c6de91e1706234f4587aa8f42a8c76d818b3055dc457b6dda51b803bf09ab0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
47c6de91e1706234f4587aa8f42a8c76d818b3055dc457b6dda51b803bf09ab0.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
47ce70cdeffbe184e4414b64b813fcaa.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
47ce70cdeffbe184e4414b64b813fcaa.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
4809a98c25f0a7be709206691dd2a0ee.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
4809a98c25f0a7be709206691dd2a0ee.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
480bfd19cce007d5891ad838d903b17e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
480bfd19cce007d5891ad838d903b17e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
4818942b6268d474373eadf8aa175f0de0315fc406eafa97d7fa7db7c154e9ae.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
4818942b6268d474373eadf8aa175f0de0315fc406eafa97d7fa7db7c154e9ae.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
485ef3e4d31b39e6107f797859f14415.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
485ef3e4d31b39e6107f797859f14415.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
486a44dd40852eb23aeca8e8951ffa61.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
486a44dd40852eb23aeca8e8951ffa61.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
487afaa2421384f1449a96637df558b4.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
487afaa2421384f1449a96637df558b4.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
488aec85d490754bc445f0e21e7d4d5146c71d500bd953b8108608d44e0351b2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
488aec85d490754bc445f0e21e7d4d5146c71d500bd953b8108608d44e0351b2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
4931b13a1265c5602753b3933aeb20740855f573997799ae8aed85ca66d193db.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
4931b13a1265c5602753b3933aeb20740855f573997799ae8aed85ca66d193db.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
4963d3411f742a92635dbd83146f3f5f7abed444f92750bcdd14072efd30e695.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
4963d3411f742a92635dbd83146f3f5f7abed444f92750bcdd14072efd30e695.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
4981b96b4a936aa6e960d3d9604a63e4.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
4981b96b4a936aa6e960d3d9604a63e4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
4996155e60aac91174cee14de1120fcb.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
4996155e60aac91174cee14de1120fcb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
49986bd925df8b3a09e58c4999927830.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
49986bd925df8b3a09e58c4999927830.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
486a44dd40852eb23aeca8e8951ffa61.exe
-
Size
54KB
-
MD5
486a44dd40852eb23aeca8e8951ffa61
-
SHA1
6fb6f73727522c1b67cf7db5853bd12e84226753
-
SHA256
ce834e57992c0f4579135e3313b176f2493712eaa6b5fd96aecd972b297d4c92
-
SHA512
d37587fc39fdf91a180f9b8b3cfdda6e804e28e82630428ca73205f70641a84e700a8f3558a928b31f59ad25d77364322e7fd5c0a37814fa21b8bcca66d6d6d4
-
SSDEEP
768:VyJZuIZ2Eslt0g5Xy3N3+dJSNXxWQG35bmaePD5PvPtXXJdxIEpmBg:Vyr1Gt0g5+NaGhWQcGDfX3xIEpmBg
Malware Config
Signatures
-
Njrat family
-
Stops running service(s) 4 TTPs
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e5cf16c381d2c6f9bd898a2b029e870.exe 486a44dd40852eb23aeca8e8951ffa61.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5e5cf16c381d2c6f9bd898a2b029e870.exe 486a44dd40852eb23aeca8e8951ffa61.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5e5cf16c381d2c6f9bd898a2b029e870 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\486a44dd40852eb23aeca8e8951ffa61.exe\" .." 486a44dd40852eb23aeca8e8951ffa61.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5e5cf16c381d2c6f9bd898a2b029e870 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\486a44dd40852eb23aeca8e8951ffa61.exe\" .." 486a44dd40852eb23aeca8e8951ffa61.exe -
pid Process 3696 powershell.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1048 sc.exe 628 sc.exe 4556 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486a44dd40852eb23aeca8e8951ffa61.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Kills process with taskkill 1 IoCs
pid Process 2952 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe 1908 486a44dd40852eb23aeca8e8951ffa61.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1908 486a44dd40852eb23aeca8e8951ffa61.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeDebugPrivilege 3696 powershell.exe Token: SeDebugPrivilege 2952 taskkill.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: 33 1908 486a44dd40852eb23aeca8e8951ffa61.exe Token: SeIncBasePriorityPrivilege 1908 486a44dd40852eb23aeca8e8951ffa61.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1908 wrote to memory of 400 1908 486a44dd40852eb23aeca8e8951ffa61.exe 91 PID 1908 wrote to memory of 400 1908 486a44dd40852eb23aeca8e8951ffa61.exe 91 PID 1908 wrote to memory of 400 1908 486a44dd40852eb23aeca8e8951ffa61.exe 91 PID 1908 wrote to memory of 4972 1908 486a44dd40852eb23aeca8e8951ffa61.exe 94 PID 1908 wrote to memory of 4972 1908 486a44dd40852eb23aeca8e8951ffa61.exe 94 PID 1908 wrote to memory of 4972 1908 486a44dd40852eb23aeca8e8951ffa61.exe 94 PID 4972 wrote to memory of 3696 4972 cmd.exe 96 PID 4972 wrote to memory of 3696 4972 cmd.exe 96 PID 4972 wrote to memory of 3696 4972 cmd.exe 96 PID 1908 wrote to memory of 3120 1908 486a44dd40852eb23aeca8e8951ffa61.exe 98 PID 1908 wrote to memory of 3120 1908 486a44dd40852eb23aeca8e8951ffa61.exe 98 PID 1908 wrote to memory of 3120 1908 486a44dd40852eb23aeca8e8951ffa61.exe 98 PID 3120 wrote to memory of 4556 3120 cmd.exe 100 PID 3120 wrote to memory of 4556 3120 cmd.exe 100 PID 3120 wrote to memory of 4556 3120 cmd.exe 100 PID 1908 wrote to memory of 1480 1908 486a44dd40852eb23aeca8e8951ffa61.exe 101 PID 1908 wrote to memory of 1480 1908 486a44dd40852eb23aeca8e8951ffa61.exe 101 PID 1908 wrote to memory of 1480 1908 486a44dd40852eb23aeca8e8951ffa61.exe 101 PID 1480 wrote to memory of 628 1480 cmd.exe 103 PID 1480 wrote to memory of 628 1480 cmd.exe 103 PID 1480 wrote to memory of 628 1480 cmd.exe 103 PID 1908 wrote to memory of 1776 1908 486a44dd40852eb23aeca8e8951ffa61.exe 104 PID 1908 wrote to memory of 1776 1908 486a44dd40852eb23aeca8e8951ffa61.exe 104 PID 1908 wrote to memory of 1776 1908 486a44dd40852eb23aeca8e8951ffa61.exe 104 PID 1776 wrote to memory of 1048 1776 cmd.exe 106 PID 1776 wrote to memory of 1048 1776 cmd.exe 106 PID 1776 wrote to memory of 1048 1776 cmd.exe 106 PID 1908 wrote to memory of 4576 1908 486a44dd40852eb23aeca8e8951ffa61.exe 107 PID 1908 wrote to memory of 4576 1908 486a44dd40852eb23aeca8e8951ffa61.exe 107 PID 1908 wrote to memory of 4576 1908 486a44dd40852eb23aeca8e8951ffa61.exe 107 PID 4576 wrote to memory of 2952 4576 cmd.exe 109 PID 4576 wrote to memory of 2952 4576 cmd.exe 109 PID 4576 wrote to memory of 2952 4576 cmd.exe 109 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 400 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\486a44dd40852eb23aeca8e8951ffa61.exe"C:\Users\Admin\AppData\Local\Temp\486a44dd40852eb23aeca8e8951ffa61.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\486a44dd40852eb23aeca8e8951ffa61.exe"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:400
-
-
C:\Windows\SysWOW64\cmd.execmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc query windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\sc.exesc query windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4556
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc stop windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\sc.exesc stop windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:628
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc delete windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\sc.exesc delete windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im Google.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Google.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82