plaguebot | 216f78a4be6357c2990ff1db5c359457d140ff27e71e9dcb374d119046e053f7

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd9a2edf17f5be8c871b7391a6739f89.exe
Size

967KB
MD5

dd9a2edf17f5be8c871b7391a6739f89
SHA1

cebd20ebdc923133ca26babec4375aa859e0c09b
SHA256

216f78a4be6357c2990ff1db5c359457d140ff27e71e9dcb374d119046e053f7
SHA512

e273d6f46beede6ab43523b49b1db3461374e17952e89bef451c1cd46ed9a8d7b894b19b3d4f28bf345f198f71fc54dc625151573c1e83bfca52a51545252f2f
SSDEEP

24576:hNxsglIPAtgV+rnEQBg2AdqgwGd9OCPltP0gxkR3dCqJO5VxQ75SY1:J7uKrnEQi2Ad/wQPLP0gx1qt5SY1

Score

10^/10

plaguebot botnet persistence

Malware Config

Signatures

PlagueBot
PlagueBot is an open source Bot written in Pascal.
botnet plaguebot

PlagueBot Executable 6 IoCs

resource	yara_rule
behavioral1/files/0x000700000001450f-6.dat	plaguebot
behavioral1/files/0x000b00000001413f-12.dat	plaguebot
behavioral1/files/0x002c0000000142ac-22.dat	plaguebot
behavioral1/files/0x002c0000000142ac-64.dat	plaguebot
behavioral1/files/0x000b00000001413f-74.dat	plaguebot
behavioral1/files/0x002c0000000142ac-108.dat	plaguebot

Drops startup file 27 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	dd9a2edf17f5be8c871b7391a6739f89.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	dd9a2edf17f5be8c871b7391a6739f89.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe	winmgr.exe

Executes dropped EXE 26 IoCs

pid	Process
2664	winmgr.exe
2428	winmgr.exe
2772	winmgr.exe
936	winmgr.exe
524	winmgr.exe
1736	winmgr.exe
1712	winmgr.exe
1160	winmgr.exe
1320	winmgr.exe
1980	winmgr.exe
1984	winmgr.exe
2524	winmgr.exe
1780	winmgr.exe
2452	winmgr.exe
2784	winmgr.exe
824	winmgr.exe
324	winmgr.exe
2368	winmgr.exe
1444	winmgr.exe
2296	winmgr.exe
2316	winmgr.exe
1820	winmgr.exe
1352	winmgr.exe
2360	winmgr.exe
2716	winmgr.exe
2556	winmgr.exe

Loads dropped DLL 27 IoCs

pid	Process
1668	dd9a2edf17f5be8c871b7391a6739f89.exe
1668	dd9a2edf17f5be8c871b7391a6739f89.exe
2664	winmgr.exe
2428	winmgr.exe
2772	winmgr.exe
936	winmgr.exe
524	winmgr.exe
1736	winmgr.exe
1712	winmgr.exe
1160	winmgr.exe
1320	winmgr.exe
1980	winmgr.exe
1984	winmgr.exe
2524	winmgr.exe
1780	winmgr.exe
2452	winmgr.exe
2784	winmgr.exe
824	winmgr.exe
324	winmgr.exe
2368	winmgr.exe
1444	winmgr.exe
2296	winmgr.exe
2316	winmgr.exe
1820	winmgr.exe
1352	winmgr.exe
2360	winmgr.exe
2716	winmgr.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	dd9a2edf17f5be8c871b7391a6739f89.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plague\\winmgr.exe"	winmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 26 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2692	schtasks.exe
2708	schtasks.exe
1736	schtasks.exe
2984	schtasks.exe
1640	schtasks.exe
1508	schtasks.exe
1080	schtasks.exe
2364	schtasks.exe
2744	schtasks.exe
3008	schtasks.exe
436	schtasks.exe
1608	schtasks.exe
1380	schtasks.exe
1812	schtasks.exe
1988	schtasks.exe
1448	schtasks.exe
1640	schtasks.exe
2804	schtasks.exe
2344	schtasks.exe
2832	schtasks.exe
2548	schtasks.exe
2340	schtasks.exe
2552	schtasks.exe
440	schtasks.exe
2124	schtasks.exe
1980	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2832	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	28
PID 1668 wrote to memory of 2832	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	28
PID 1668 wrote to memory of 2832	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	28
PID 1668 wrote to memory of 2832	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	28
PID 1668 wrote to memory of 2148	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	30
PID 1668 wrote to memory of 2148	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	30
PID 1668 wrote to memory of 2148	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	30
PID 1668 wrote to memory of 2148	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	30
PID 1668 wrote to memory of 2664	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	32
PID 1668 wrote to memory of 2664	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	32
PID 1668 wrote to memory of 2664	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	32
PID 1668 wrote to memory of 2664	1668	dd9a2edf17f5be8c871b7391a6739f89.exe	32
PID 2664 wrote to memory of 1640	2664	winmgr.exe	33
PID 2664 wrote to memory of 1640	2664	winmgr.exe	33
PID 2664 wrote to memory of 1640	2664	winmgr.exe	33
PID 2664 wrote to memory of 1640	2664	winmgr.exe	33
PID 2664 wrote to memory of 2520	2664	winmgr.exe	35
PID 2664 wrote to memory of 2520	2664	winmgr.exe	35
PID 2664 wrote to memory of 2520	2664	winmgr.exe	35
PID 2664 wrote to memory of 2520	2664	winmgr.exe	35
PID 2664 wrote to memory of 2428	2664	winmgr.exe	37
PID 2664 wrote to memory of 2428	2664	winmgr.exe	37
PID 2664 wrote to memory of 2428	2664	winmgr.exe	37
PID 2664 wrote to memory of 2428	2664	winmgr.exe	37
PID 2428 wrote to memory of 2548	2428	winmgr.exe	38
PID 2428 wrote to memory of 2548	2428	winmgr.exe	38
PID 2428 wrote to memory of 2548	2428	winmgr.exe	38
PID 2428 wrote to memory of 2548	2428	winmgr.exe	38
PID 2428 wrote to memory of 2932	2428	winmgr.exe	40
PID 2428 wrote to memory of 2932	2428	winmgr.exe	40
PID 2428 wrote to memory of 2932	2428	winmgr.exe	40
PID 2428 wrote to memory of 2932	2428	winmgr.exe	40
PID 2428 wrote to memory of 2772	2428	winmgr.exe	42
PID 2428 wrote to memory of 2772	2428	winmgr.exe	42
PID 2428 wrote to memory of 2772	2428	winmgr.exe	42
PID 2428 wrote to memory of 2772	2428	winmgr.exe	42
PID 2772 wrote to memory of 2744	2772	winmgr.exe	43
PID 2772 wrote to memory of 2744	2772	winmgr.exe	43
PID 2772 wrote to memory of 2744	2772	winmgr.exe	43
PID 2772 wrote to memory of 2744	2772	winmgr.exe	43
PID 2772 wrote to memory of 2828	2772	winmgr.exe	45
PID 2772 wrote to memory of 2828	2772	winmgr.exe	45
PID 2772 wrote to memory of 2828	2772	winmgr.exe	45
PID 2772 wrote to memory of 2828	2772	winmgr.exe	45
PID 2772 wrote to memory of 936	2772	winmgr.exe	47
PID 2772 wrote to memory of 936	2772	winmgr.exe	47
PID 2772 wrote to memory of 936	2772	winmgr.exe	47
PID 2772 wrote to memory of 936	2772	winmgr.exe	47
PID 936 wrote to memory of 1988	936	winmgr.exe	48
PID 936 wrote to memory of 1988	936	winmgr.exe	48
PID 936 wrote to memory of 1988	936	winmgr.exe	48
PID 936 wrote to memory of 1988	936	winmgr.exe	48
PID 936 wrote to memory of 776	936	winmgr.exe	50
PID 936 wrote to memory of 776	936	winmgr.exe	50
PID 936 wrote to memory of 776	936	winmgr.exe	50
PID 936 wrote to memory of 776	936	winmgr.exe	50
PID 936 wrote to memory of 524	936	winmgr.exe	52
PID 936 wrote to memory of 524	936	winmgr.exe	52
PID 936 wrote to memory of 524	936	winmgr.exe	52
PID 936 wrote to memory of 524	936	winmgr.exe	52
PID 524 wrote to memory of 2692	524	winmgr.exe	53
PID 524 wrote to memory of 2692	524	winmgr.exe	53
PID 524 wrote to memory of 2692	524	winmgr.exe	53
PID 524 wrote to memory of 2692	524	winmgr.exe	53

C:\Users\Admin\AppData\Local\Temp\dd9a2edf17f5be8c871b7391a6739f89.exe
"C:\Users\Admin\AppData\Local\Temp\dd9a2edf17f5be8c871b7391a6739f89.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2832
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Query /FO "LIST" /TN "WinManager"
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
  "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
    3⤵
    - Creates scheduled task(s)
    PID:1640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Query /FO "LIST" /TN "WinManager"
    3⤵
    PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
    "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
      4⤵
      Creates scheduled task(s)
      PID:2548
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Query /FO "LIST" /TN "WinManager"
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
      "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        5⤵
        Creates scheduled task(s)
        
        PID:2744
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        5⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:936
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        6⤵
        Creates scheduled task(s)
        
        PID:1988
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        6⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        6⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:524
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        7⤵
        Creates scheduled task(s)
        
        PID:2692
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        7⤵
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        7⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1736
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        8⤵
        Creates scheduled task(s)
        
        PID:1508
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        8⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        8⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1712
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        9⤵
        Creates scheduled task(s)
        
        PID:3008
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        9⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        9⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1160
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        10⤵
        Creates scheduled task(s)
        
        PID:436
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        10⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        10⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1320
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        11⤵
        Creates scheduled task(s)
        
        PID:2340
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        11⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        11⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1980
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        12⤵
        Creates scheduled task(s)
        
        PID:1448
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        12⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        12⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1984
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        13⤵
        Creates scheduled task(s)
        
        PID:1080
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        13⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        13⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2524
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        14⤵
        Creates scheduled task(s)
        
        PID:2552
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        14⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        14⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1780
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        15⤵
        Creates scheduled task(s)
        
        PID:1640
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        15⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        15⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2452
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        16⤵
        Creates scheduled task(s)
        
        PID:2708
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        16⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        16⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2784
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        17⤵
        Creates scheduled task(s)
        
        PID:2804
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        17⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        17⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:824
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        18⤵
        Creates scheduled task(s)
        
        PID:2344
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        18⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        18⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:324
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        19⤵
        Creates scheduled task(s)
        
        PID:440
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        19⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        19⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2368
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        20⤵
        Creates scheduled task(s)
        
        PID:1608
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        20⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        20⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1444
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        21⤵
        Creates scheduled task(s)
        
        PID:1736
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        21⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        21⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2296
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        22⤵
        Creates scheduled task(s)
        
        PID:1380
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        22⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        22⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2316
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        23⤵
        Creates scheduled task(s)
        
        PID:1812
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        23⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        23⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1820
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        24⤵
        Creates scheduled task(s)
        
        PID:2124
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        24⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        24⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1352
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        25⤵
        Creates scheduled task(s)
        
        PID:2364
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        25⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        25⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2360
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        26⤵
        Creates scheduled task(s)
        
        PID:1980
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        26⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        26⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2716
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        27⤵
        Creates scheduled task(s)
        
        PID:2984
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        27⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        27⤵
        Executes dropped EXE
        
        PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
87639247d9a260e20f9e1de283bbf123

SHA1
e6b8ed2230a98565cdfe865b17c6c835148e3744

SHA256
93a19ea2145395add38a0d2ce8bb65b97e2b4815146d8474ead4727b5a1de366

SHA512
9d3801f8a0dad076504136a3abdeb5c28241ee7a58a42c97ad3ed74251f9e803f89146b2cfb0a18cceebe71b799688e1c1b220a2416ee00de863292fecf43e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
027f1fa00c6ce18193b4044df5da1a74

SHA1
acce58b327b74b7f7dbc85c802ef8a2184c25335

SHA256
24885888bd39ad1d894b490c6dd9295916f56c06169068e61613140921993e36

SHA512
4b88120d6db0eb9606200af234d74b9151d46031c68603ff42fcf03e08138dcb40477b25540147e76f2b709f81ee8e8dc40195e5e4f054077a190325480de089

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
0b0d2b04742b69ec1874153851124165

SHA1
892d1b6d0093f37295d68790a0de5b3155121f01

SHA256
066cfcc58392a85025deea3bbf39159967f65d4205e207d684d86b01cea5459e

SHA512
980b354cc7bfa7397746fcca4114a72fdec9c4a63afb24534ef19bf035e60fb9ad15372fb0fc1a1d8cae154f313d8cec418b1085bf8db54d9c1e36cef554e3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
daac6d7cd4f0d59adf09726807e2ef25

SHA1
b4e013d115c982ee8487a2201f7a685216bb5094

SHA256
88431ec99ed0c10aed8a253e1b6136604ea499cd56d8c431ccd5f2014450b0b7

SHA512
5ec4df3242df6d26fe94412178450ac0c3afb09a429896d6bfc7a1fea462b768531a5259444f53d5baf69bce1fb1fb8e3823e92141a8eace3e8349825947d89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
c43c56045beb9c68c10541995f4a8ffd

SHA1
a75c79dbf5de6c903602c2e44efa7724030dfc4c

SHA256
7af9cc853cc1ce8df798ebf86369cc949bd2a4ac7bdca2bbae1763cf9367fa49

SHA512
093cf566f3d022378b1885edc05be0d7a52066f64be6b2dcc4099f44a6e376542ec1fe11bce32e122c0ed78bbbfa87a9b1ba9f7ce883f8d6a1968cdaba6e7288

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
74fc2e506cdf0872ebd744622f750ad9

SHA1
5ac9b03004997c94bf1ff8da0d5d54fed3c34947

SHA256
18ca6878f2a4f64c326e88c5f0a4484f84ee01be81e99831cf392cd41a5ddbfd

SHA512
18fefe5cacb276190fa80fb85d8212ea9b93c57365cc102bc86736dec2a0d7740c4563c04d7817335892ad477ee6bc450587358ef748885ec57273c2fce7a44b

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
ee6ab72f4a64142fefdf9e1de3f996c9

SHA1
d1e4d61539dd64fec084e1123204cfa6708e05b7

SHA256
abbdbf2ef1872eff34a91c4f7fb56ce772e3da770e36711d0531dfb359dc4cd9

SHA512
329b7fb91008548b8baf40e56b6cd3cd8eed02b56756f602d9ffd7d0ddd25cef04d02deb2ad0cbb0e18b0b49a8eddb339adbe9b16a4509655b77a994e7765e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
e8abdfb0fbeabca9337b6ff46b02546e

SHA1
107d1b5d77968e043e3990222a9ccb6f37ff81db

SHA256
57a297660cd3bc7355886507e80e3c63841ac630990ccc74ad5f927d188a4287

SHA512
10100537c4eb901ab7df0c72efe99dfff3476b70906ee4bb8a44e5acdabc194b9d067aae4f436a56677ce4760cb57f738b089942bdb53fd1a46e06eb274577f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
45c1cae6a1a38dd10c0aa39d57b7396e

SHA1
cdd5f8b03bb447e971a3fb48cf552668765138fc

SHA256
0531d93ed08a0d6a8ed089c741be979b7e49fab3d04c9d47ef7e931434888d0d

SHA512
92a09e104068e6acde5b856035b35e92b94c524eb82b601756442be4f05d1888a398e09a074c57adbe2ae31045972a7a2cc893db91f012676ec159e9ed6e4241

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
38cd82b9e521b84c4300c65b6bad0a40

SHA1
f69d16a13dad9eec160dc83440cf0851f99f3af3

SHA256
abd5ea554d335e7acd55d46baee01974561dc84238272700c8f676beaab6cf16

SHA512
769617794f65e71274afe6cace7f489d974a5a8184a28d0aa56fcd0705fc982269fc05a2698f462381d6b74627718005752d45e235438b46813f0c9eb2f0a188

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
8846eeaa43b43878030ff14746fadc31

SHA1
703844f51c0c2692f86a5764f85f6ba777e2f180

SHA256
0d160b8d6043809e80b0d010d7b3e7aab05d78691dcd17a0f44733ae2c920793

SHA512
e9de3a1a369821bb50df14ec06f8e7ac9044a656bb2ea9e78b9b597eceabbef9c16f5d637238cd8d47dee04de32ebb5cfbd960639979b3a742fbc9f8bb050ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
4f88582f03147b94f224b05964e542d2

SHA1
89b9494f8796e11b7f3bfd7b0c028e1f5cb3773d

SHA256
e5a6b34e5d6cdec394ffa98a3666edc86b5e0f6124c1b4323b9355ebf1215566

SHA512
f4580278caf72f49f4d3663c0883f4bc9585740ecf2839fd1684907e4ced9e51efd95c2263c70e119ee1d8a0d212ad881cd8d3d50ec8d80a0d8bafeae2c7ac8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
8f319daebdd90c8329d2779f9fcb6038

SHA1
043b1c80ff7dbcd7ae6e538c5512ba0bc0c02ebe

SHA256
b34e5b8af42fef815e7ca748694c6c3ac7fbcb301d76f4f29a5e24d6154ac286

SHA512
428d489c838ef38917da04660a09821495aa8478e5da27dc27e8fd847a4fbd5c66b98aa52984b73cdb7e32a388ec4152d0041393bba80cc5a8a3888daea4b5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
617a37dcc9cdf6a521c574ae7ce67552

SHA1
7b5619780e7b6ab761523f12435929ce388fabbc

SHA256
65dd7b03c8485ea66cec7479c36856036e4eada8e9108bcf193afc53f32d60e0

SHA512
4ba474e9195e532f5a2fb4d0fdd8270ff767771e88b7ce365c9cbdc1977894868d252ae695c395df7f4d8317a8c265d417bfdc2edd3559cb0dc32de03bd0696e

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
1ee4bae47e6bab532a1f94c896d3b901

SHA1
e68a435008045dd73c21b254f3071b82235bfc83

SHA256
d38f08dd484635827211558e6f6cc5fe7e48a31d8592025e1004b5e9505f2b61

SHA512
824246aacf994f8892e7476edc22138cd459178a31ccf338f95dcedacb26b46d20ff5af57480834f4385dd18e6272df3a0401c2b52667cf676ba2bfe8760f733

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plague\RCX4682.tmp

Filesize
967KB

MD5
c01481cc14f98455d7d815b260213893

SHA1
c1781719d8d64e3f3c4a755e8f46ca83b9803edf

SHA256
266a173350354b2831a2cf32849e664421c5ed2c2bf0b0254e6aea690dcbeadf

SHA512
7954ef5c54c68e3904888f9ea0928e44640ba0c2f2b1f21f775993b114104fbe5b85f76a0aa80469e131d9cafadcfbb820a443124484c7caeb8ee48557b9b6b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe

Filesize
967KB

MD5
b047d616be14659a07a0e619ce9320dc

SHA1
248235362df20df15393629a9977def909e4f0e4

SHA256
b352625bebf20aed9ce1ba6857ad0f416c77925007a51b1575e6db4994ea331a

SHA512
b49e437afa04e5f4080bc90abc00f3482c87dc4bafac945bf484198cc006857e23aee8903b4a864727f7d70f6236e7fc5b685a7b4fad0f953ece0c1330a658d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe

Filesize
967KB

MD5
905a484c214bd63a7ab2aab9560169ae

SHA1
3d19ea920950b838c4a4bc512cbdd1e6f955b387

SHA256
b4fcb2a8a1f74795cd402584b3a8ed2fae7b6d0192da5afff92c7f250366a4bb

SHA512
ad6a44b0991c41654d7431020c1395314feaf1905941e66589cfda8161a8b6d43883958eda6b93eb4a8b232d6af2a86f3a1068a52c735c516a6ceb9bce56fc78

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe

Filesize
967KB

MD5
5cfcd8dbefff5fdb072c749cf39c10f3

SHA1
37c0b81bdb9ab780260a2d4cdadd6e4934e07484

SHA256
e353eddbc31efb00eb53d25ab512a78cc048451a04b40f76d99d13321c48fd1e

SHA512
c129e00086d1dcf7a7e5e4b3707dc3f79aed2e17fd5f4a39ab0ad2fa661b4c2cb391f8b5ff94aee11634447337bfa7cfd84d133226f4d6edbd5dbc3304238985

Download Submit
\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe

Filesize
967KB

MD5
dd9a2edf17f5be8c871b7391a6739f89

SHA1
cebd20ebdc923133ca26babec4375aa859e0c09b

SHA256
216f78a4be6357c2990ff1db5c359457d140ff27e71e9dcb374d119046e053f7

SHA512
e273d6f46beede6ab43523b49b1db3461374e17952e89bef451c1cd46ed9a8d7b894b19b3d4f28bf345f198f71fc54dc625151573c1e83bfca52a51545252f2f

Download Submit
\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe

Filesize
365KB

MD5
c81d36ee663bb3a7c3f1d88c1e89e965

SHA1
0089fa1fb4947dea81d110c7b6a7b747483bbe4f

SHA256
8997830ad04e96dec15d069fccfc978ff4f45139ed0be736b7a9610063abdde4

SHA512
683f3151f482ef1a1fe00f4126546b99d92def3abbef01fb0845613a24054cf6b00ea47e9871eb7dd1035aea6cc9f16a67f039809f95fa3f4fae8c23955ce25c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads