Analysis
-
max time kernel
161s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
27-03-2024 11:29
General
-
Target
e18ec27f09521152664d6a5aad14f03e.exe
-
Size
173KB
-
MD5
e18ec27f09521152664d6a5aad14f03e
-
SHA1
747bbc767b7a4aedc13a6b2d2f0a8a63363fc91c
-
SHA256
1ee3e5b5f7b2deb6182a591e94890786e404054e536dc468960d941c733d1e00
-
SHA512
3180a6de45526927ea7099b52a7c191ac1e4e6bff1fb55f1e03f7369ef6a316ff7a93ee533aa587c0ecb03e3f604e449ae8fd8547bd99aff7ea8382e98d4138b
-
SSDEEP
3072:YWzzzZKkF8xgsfifWFDZxbvPtj006jxyLNPs4EzhiXJbH5HGWSu9igjc:FDQg8uFUlxbvVjqjNuJbH5Hyn
Score
10/10
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
-
Drops file in Drivers directory 13 IoCs
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 15 IoCs
-
Adds Run key to start application 2 TTPs 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 62 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e18ec27f09521152664d6a5aad14f03e.exe"C:\Users\Admin\AppData\Local\Temp\e18ec27f09521152664d6a5aad14f03e.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "3⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "3⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "4⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "4⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute4⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"3⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "5⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "5⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute5⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"4⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "6⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "6⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute6⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"5⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "6⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "7⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "6⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "7⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute6⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute7⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"6⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "7⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "8⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "7⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "8⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute7⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute8⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"7⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "8⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "9⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "8⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "9⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute8⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute9⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"8⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "9⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "10⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "9⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "10⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute9⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute10⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f9⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"9⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "10⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "11⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "10⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "11⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute10⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute11⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"10⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "11⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "12⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "11⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "12⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute11⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute12⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"11⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "12⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "13⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "12⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "13⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute12⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute13⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"12⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "13⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "14⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "13⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "14⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute13⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute14⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f13⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"13⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "14⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "15⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "14⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "15⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute14⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute15⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f14⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"14⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "15⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\mscfile\Shell\Open\command /t REG_SZ /f /d "16⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "15⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /t REG_SZ /f /d "16⤵
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute15⤵
-
C:\Windows\system32\reg.exeREG delete HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command /f /v DelegateExecute16⤵
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn WindowsUpdateIt /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe\" " /sc minute /f15⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.logFilesize
1KB
MD5f6d83cb3ec0cf035c26b86a8009ab714
SHA19c2d16be04908f2d28ce66b41ca4487b618534b3
SHA2562abe8a8f5bc11a760fed80a31be099fc4ffe88cf786ccec2d6b0610877910212
SHA5129f94dfc2f18ab2130698724a6a6e54c3ddb4f7695b60e71eaee9b2ed0ca09fdc30830bf70de450814260c771674988999b8b94bf78dec6cbb068c8bd073b1696
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft\Update.exeFilesize
173KB
MD5e18ec27f09521152664d6a5aad14f03e
SHA1747bbc767b7a4aedc13a6b2d2f0a8a63363fc91c
SHA2561ee3e5b5f7b2deb6182a591e94890786e404054e536dc468960d941c733d1e00
SHA5123180a6de45526927ea7099b52a7c191ac1e4e6bff1fb55f1e03f7369ef6a316ff7a93ee533aa587c0ecb03e3f604e449ae8fd8547bd99aff7ea8382e98d4138b
-
C:\Windows\System32\drivers\etc\hostsFilesize
214B
MD51d5b73b1aba270a6b6d36aefea898e01
SHA1dec93ea81f69e1ff12d93cd40d76a1c339430bbc
SHA2564799790bae91e31f69bb8148df60c8b2c28cd85fde380b1789f43d0686725b11
SHA51251c8cc15b0cc4766353c7852ea78a56b8a23adbc189cb73cbb2c3198a0c29f3c9746411a313715756edc83331d13e238ae72c2f377c554edb3a36a49c870f285
-
memory/416-40-0x0000028974860000-0x0000028974960000-memory.dmpFilesize
1024KB
-
memory/416-39-0x0000028974460000-0x0000028974470000-memory.dmpFilesize
64KB
-
memory/416-38-0x0000028974460000-0x0000028974470000-memory.dmpFilesize
64KB
-
memory/416-41-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/416-43-0x0000028974860000-0x0000028974960000-memory.dmpFilesize
1024KB
-
memory/416-37-0x0000028974460000-0x0000028974470000-memory.dmpFilesize
64KB
-
memory/416-42-0x0000028974860000-0x0000028974960000-memory.dmpFilesize
1024KB
-
memory/416-32-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/416-34-0x0000028974460000-0x0000028974470000-memory.dmpFilesize
64KB
-
memory/416-33-0x000002895A320000-0x000002895A336000-memory.dmpFilesize
88KB
-
memory/416-45-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/2452-70-0x000002F42EF20000-0x000002F42F020000-memory.dmpFilesize
1024KB
-
memory/2452-60-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/2452-61-0x000002F42ECB0000-0x000002F42ECC0000-memory.dmpFilesize
64KB
-
memory/2452-64-0x000002F42ECB0000-0x000002F42ECC0000-memory.dmpFilesize
64KB
-
memory/2452-65-0x000002F42ECB0000-0x000002F42ECC0000-memory.dmpFilesize
64KB
-
memory/2452-66-0x000002F42ECB0000-0x000002F42ECC0000-memory.dmpFilesize
64KB
-
memory/2452-67-0x000002F42EF20000-0x000002F42F020000-memory.dmpFilesize
1024KB
-
memory/2452-68-0x000002F42EF20000-0x000002F42F020000-memory.dmpFilesize
1024KB
-
memory/2452-69-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/2452-71-0x000002F42EF20000-0x000002F42F020000-memory.dmpFilesize
1024KB
-
memory/2452-73-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/3332-85-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/3332-86-0x000001D2C5E90000-0x000001D2C5EA0000-memory.dmpFilesize
64KB
-
memory/3332-87-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4228-50-0x0000028CCE030000-0x0000028CCE040000-memory.dmpFilesize
64KB
-
memory/4228-57-0x0000028CE85C0000-0x0000028CE86C0000-memory.dmpFilesize
1024KB
-
memory/4228-46-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4228-47-0x0000028CCE030000-0x0000028CCE040000-memory.dmpFilesize
64KB
-
memory/4228-59-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4228-51-0x0000028CCE030000-0x0000028CCE040000-memory.dmpFilesize
64KB
-
memory/4228-52-0x0000028CCE030000-0x0000028CCE040000-memory.dmpFilesize
64KB
-
memory/4228-53-0x0000028CCE030000-0x0000028CCE040000-memory.dmpFilesize
64KB
-
memory/4228-54-0x0000028CCE030000-0x0000028CCE040000-memory.dmpFilesize
64KB
-
memory/4228-55-0x0000028CE85C0000-0x0000028CE86C0000-memory.dmpFilesize
1024KB
-
memory/4228-56-0x0000028CE85C0000-0x0000028CE86C0000-memory.dmpFilesize
1024KB
-
memory/4352-80-0x0000010FCC1B0000-0x0000010FCC1C0000-memory.dmpFilesize
64KB
-
memory/4352-82-0x0000010FCC1B0000-0x0000010FCC1C0000-memory.dmpFilesize
64KB
-
memory/4352-92-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4352-90-0x0000010FCC4F0000-0x0000010FCC5F0000-memory.dmpFilesize
1024KB
-
memory/4352-89-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4352-88-0x0000010FCC4F0000-0x0000010FCC5F0000-memory.dmpFilesize
1024KB
-
memory/4352-83-0x0000010FCC4F0000-0x0000010FCC5F0000-memory.dmpFilesize
1024KB
-
memory/4352-81-0x0000010FCC1B0000-0x0000010FCC1C0000-memory.dmpFilesize
64KB
-
memory/4352-79-0x0000010FCC1B0000-0x0000010FCC1C0000-memory.dmpFilesize
64KB
-
memory/4352-78-0x0000010FCC1B0000-0x0000010FCC1C0000-memory.dmpFilesize
64KB
-
memory/4352-75-0x0000010FCC1B0000-0x0000010FCC1C0000-memory.dmpFilesize
64KB
-
memory/4352-74-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4912-23-0x000001F54B2F0000-0x000001F54B300000-memory.dmpFilesize
64KB
-
memory/4912-24-0x000001F54B2F0000-0x000001F54B300000-memory.dmpFilesize
64KB
-
memory/4912-27-0x000001F5646E0000-0x000001F5647E0000-memory.dmpFilesize
1024KB
-
memory/4912-19-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4912-26-0x000001F5646E0000-0x000001F5647E0000-memory.dmpFilesize
1024KB
-
memory/4912-31-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4912-25-0x000001F5646E0000-0x000001F5647E0000-memory.dmpFilesize
1024KB
-
memory/4912-22-0x000001F54B2F0000-0x000001F54B300000-memory.dmpFilesize
64KB
-
memory/4912-20-0x000001F54B2F0000-0x000001F54B300000-memory.dmpFilesize
64KB
-
memory/4928-4-0x000001E8F65A0000-0x000001E8F65AC000-memory.dmpFilesize
48KB
-
memory/4928-3-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB
-
memory/4928-1-0x000001E8F6580000-0x000001E8F6590000-memory.dmpFilesize
64KB
-
memory/4928-2-0x000001E8F6590000-0x000001E8F65A6000-memory.dmpFilesize
88KB
-
memory/4928-5-0x000001E8F6570000-0x000001E8F6580000-memory.dmpFilesize
64KB
-
memory/4928-0-0x000001E8F4830000-0x000001E8F4862000-memory.dmpFilesize
200KB
-
memory/4928-18-0x00007FFAC7BF0000-0x00007FFAC86B1000-memory.dmpFilesize
10.8MB