Overview
overview
10Static
static
10The-MALWAR...ot.exe
windows7-x64
10The-MALWAR...ot.exe
windows10-2004-x64
10The-MALWAR...ll.exe
windows7-x64
10The-MALWAR...ll.exe
windows10-2004-x64
10The-MALWAR...BS.exe
windows7-x64
10The-MALWAR...BS.exe
windows10-2004-x64
10The-MALWAR...in.exe
windows7-x64
7The-MALWAR...in.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
7The-MALWAR....A.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
10The-MALWAR....A.exe
windows10-2004-x64
10The-MALWAR....A.dll
windows7-x64
7The-MALWAR....A.dll
windows10-2004-x64
6The-MALWAR...r.xlsm
windows7-x64
10The-MALWAR...r.xlsm
windows10-2004-x64
10The-MALWAR...36c859
ubuntu-20.04-amd64
8The-MALWAR...caa742
ubuntu-20.04-amd64
8The-MALWAR...c1a732
ubuntu-18.04-amd64
8The-MALWAR...460a01
ubuntu-20.04-amd64
8The-MALWAR...ece0c5
ubuntu-20.04-amd64
8The-MALWAR...257619
ubuntu-20.04-amd64
8The-MALWAR...fbcc59
ubuntu-18.04-amd64
8The-MALWAR...54f69c
ubuntu-18.04-amd64
8The-MALWAR...d539a6
ubuntu-20.04-amd64
8The-MALWAR...4996dd
ubuntu-20.04-amd64
8The-MALWAR...8232d5
ubuntu-20.04-amd64
8The-MALWAR...66b948
ubuntu-20.04-amd64
8The-MALWAR...f9db86
ubuntu-18.04-amd64
8The-MALWAR...ea2485
ubuntu-20.04-amd64
8The-MALWAR...us.exe
windows7-x64
6The-MALWAR...us.exe
windows10-2004-x64
6Resubmissions
29-04-2024 17:56
240429-wjgllsgg29 1017-04-2024 14:59
240417-sc15wsef8y 1016-04-2024 14:20
240416-rnxq6sdg3t 10Analysis
-
max time kernel
1809s -
max time network
1820s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 17:56
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/001eb377f0452060012124cb214f658754c7488ccb82e23ec56b2f45a636c859
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/3205603282a636979a55aa1e1be518cd3adcbbe491745d996ceb4b5a4dece0c5
Resource
ubuntu2004-amd64-20240418-en
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/453468b86856665f2cc0e0e71668c0b6aac8b14326c623995ba5963f22257619
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
Resource
ubuntu1804-amd64-20240418-en
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/7745b070943e910e8807e3521ac7b7a01401d131bf6c18a63433f8177ed539a6
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
Resource
ubuntu2004-amd64-20240418-en
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
Resource
ubuntu2004-amd64-20240418-en
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
Resource
ubuntu2004-amd64-20240418-en
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/d1e82d4a37959a9e6b661e31b8c8c6d2813c93ac92508a2771b2491b04ea2485
Resource
ubuntu2004-amd64-20240418-en
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win10v2004-20240419-en
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
pid process 1408 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uxhwu = "\"C:\\Users\\Admin\\AppData\\Roaming\\7fiJt\\rstrui.exe\"" -
Drops file in System32 directory 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\system32\Prr74d\rstrui.exe cmd.exe File opened for modification C:\Windows\system32\Prr74d\rstrui.exe cmd.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\fd2lH44.cmd" Key deleted \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open\command Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell Key deleted \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open\command Key deleted \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open Key deleted \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 2460 rundll32.exe 2460 rundll32.exe 2460 rundll32.exe 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 1408 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1408 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1408 Token: SeShutdownPrivilege 1408 Token: SeShutdownPrivilege 1408 Token: SeShutdownPrivilege 1408 Token: SeShutdownPrivilege 1408 Token: SeShutdownPrivilege 1408 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
eventvwr.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1408 wrote to memory of 1884 1408 rstrui.exe PID 1408 wrote to memory of 1884 1408 rstrui.exe PID 1408 wrote to memory of 1884 1408 rstrui.exe PID 1408 wrote to memory of 1236 1408 cmd.exe PID 1408 wrote to memory of 1236 1408 cmd.exe PID 1408 wrote to memory of 1236 1408 cmd.exe PID 1408 wrote to memory of 2548 1408 rstrui.exe PID 1408 wrote to memory of 2548 1408 rstrui.exe PID 1408 wrote to memory of 2548 1408 rstrui.exe PID 1408 wrote to memory of 2772 1408 cmd.exe PID 1408 wrote to memory of 2772 1408 cmd.exe PID 1408 wrote to memory of 2772 1408 cmd.exe PID 1408 wrote to memory of 2932 1408 eventvwr.exe PID 1408 wrote to memory of 2932 1408 eventvwr.exe PID 1408 wrote to memory of 2932 1408 eventvwr.exe PID 2932 wrote to memory of 2008 2932 eventvwr.exe cmd.exe PID 2932 wrote to memory of 2008 2932 eventvwr.exe cmd.exe PID 2932 wrote to memory of 2008 2932 eventvwr.exe cmd.exe PID 2008 wrote to memory of 1948 2008 cmd.exe schtasks.exe PID 2008 wrote to memory of 1948 2008 cmd.exe schtasks.exe PID 2008 wrote to memory of 1948 2008 cmd.exe schtasks.exe PID 1408 wrote to memory of 1540 1408 cmd.exe PID 1408 wrote to memory of 1540 1408 cmd.exe PID 1408 wrote to memory of 1540 1408 cmd.exe PID 1540 wrote to memory of 2400 1540 cmd.exe schtasks.exe PID 1540 wrote to memory of 2400 1540 cmd.exe schtasks.exe PID 1540 wrote to memory of 2400 1540 cmd.exe schtasks.exe PID 1408 wrote to memory of 768 1408 cmd.exe PID 1408 wrote to memory of 768 1408 cmd.exe PID 1408 wrote to memory of 768 1408 cmd.exe PID 768 wrote to memory of 2264 768 cmd.exe schtasks.exe PID 768 wrote to memory of 2264 768 cmd.exe schtasks.exe PID 768 wrote to memory of 2264 768 cmd.exe schtasks.exe PID 1408 wrote to memory of 2124 1408 cmd.exe PID 1408 wrote to memory of 2124 1408 cmd.exe PID 1408 wrote to memory of 2124 1408 cmd.exe PID 2124 wrote to memory of 2544 2124 cmd.exe schtasks.exe PID 2124 wrote to memory of 2544 2124 cmd.exe schtasks.exe PID 2124 wrote to memory of 2544 2124 cmd.exe schtasks.exe PID 1408 wrote to memory of 3064 1408 cmd.exe PID 1408 wrote to memory of 3064 1408 cmd.exe PID 1408 wrote to memory of 3064 1408 cmd.exe PID 3064 wrote to memory of 1048 3064 cmd.exe schtasks.exe PID 3064 wrote to memory of 1048 3064 cmd.exe schtasks.exe PID 3064 wrote to memory of 1048 3064 cmd.exe schtasks.exe PID 1408 wrote to memory of 2644 1408 cmd.exe PID 1408 wrote to memory of 2644 1408 cmd.exe PID 1408 wrote to memory of 2644 1408 cmd.exe PID 2644 wrote to memory of 1828 2644 cmd.exe schtasks.exe PID 2644 wrote to memory of 1828 2644 cmd.exe schtasks.exe PID 2644 wrote to memory of 1828 2644 cmd.exe schtasks.exe PID 1408 wrote to memory of 2944 1408 cmd.exe PID 1408 wrote to memory of 2944 1408 cmd.exe PID 1408 wrote to memory of 2944 1408 cmd.exe PID 2944 wrote to memory of 2976 2944 cmd.exe schtasks.exe PID 2944 wrote to memory of 2976 2944 cmd.exe schtasks.exe PID 2944 wrote to memory of 2976 2944 cmd.exe schtasks.exe PID 1408 wrote to memory of 1624 1408 cmd.exe PID 1408 wrote to memory of 1624 1408 cmd.exe PID 1408 wrote to memory of 1624 1408 cmd.exe PID 1624 wrote to memory of 1356 1624 cmd.exe schtasks.exe PID 1624 wrote to memory of 1356 1624 cmd.exe schtasks.exe PID 1624 wrote to memory of 1356 1624 cmd.exe schtasks.exe PID 1408 wrote to memory of 1608 1408 cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵PID:1884
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Z8iH.cmd1⤵PID:1236
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵PID:2548
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\lhsR.cmd1⤵
- Drops file in System32 directory
PID:2772
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\fd2lH44.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Trqxvscxs" /TR C:\Windows\system32\Prr74d\rstrui.exe /SC minute /MO 60 /RL highest3⤵
- Creates scheduled task(s)
PID:1948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2400
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2264
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1048
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1828
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2976
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1356
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1708
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2232
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2716
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2332
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2376
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:3052
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:840
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2696
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1888
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1600
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2636
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1744
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2556
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1996
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:592
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2972
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:416
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1048
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2720
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2732
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2020
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:916
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1384
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2092
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1584
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2924
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1892
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2368
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2664
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2704
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1776
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1236
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1904
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2812
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1116
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:956
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2400
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1784
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1208
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1720
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:860
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2960
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1472
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1524
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1532
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1180
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1972
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1712
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1872
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:240
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2300
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2076
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2008
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2580
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2716
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2500
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2856
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1012
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2312
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2772
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2812
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2320
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1920
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1176
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:932
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2272
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2064
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:524
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2744
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:3060
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1788
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1112
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2040
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1056
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2108
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2060
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1572
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1704
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2092
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2232
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1968
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2200
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2148
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2844
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2608
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2124
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1640
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2132
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1644
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1752
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2636
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2876
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1996
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1460
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2972
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2384
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2052
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1944
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2192
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2420
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:980
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:948
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2660
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1084
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:892
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1948
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2572
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2924
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2680
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2500
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2452
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2416
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1300
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1012
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2828
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2372
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2224
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:956
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2180
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2032
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2252
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2064
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2140
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2744
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:436
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1668
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1828
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2040
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2976
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2508
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1676
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2872
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2088
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2556
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2776
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1892
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1120
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2148
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2908
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2608
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1632
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2808
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2820
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1908
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2400
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:2868
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:2588
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Trqxvscxs"1⤵PID:1140
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Trqxvscxs"2⤵PID:1100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD55d528ead026c16a5fd4b61394d49ee21
SHA12e10fd784274bfdab0a5d3248d807929338d58e9
SHA2566cb62e0f2754105b70132adf10b77198c1beaa6f7cea267ef402e4c725a730c3
SHA5127c838a7321199571376c9aa1656674356914537c58d43eae413af08604ae809c824bd93618a8bba97f9981f700899ec6c5f43dd350bac1a2fe81b295975455e7
-
Filesize
228B
MD5dc64d7a03ed2eb7e5496f4f9ed78bf49
SHA17a6ecd154a3cf899bedd9e89846b9dcbeb0a7020
SHA256e32977e1d394940c458ce1546494e4235b58b44d0821b9a97774076f24217b58
SHA51233ab57d9a3ece9e963c44952950bf30b357cf1963b8fa9c92a8766fbbdab39c1a182680127ebb6e5324040ab474a99ce5eb1a800903874001d58643943f16c58
-
Filesize
628KB
MD513175af1f427f7e94995b17c7a4c38ac
SHA168d00e4b3c6d5fddd1b21fa68bfff24f7daf804b
SHA256f205699b554e0372dd269cde6eaac524670847cf9bda9c765ad91582cd9cb4ae
SHA5124e09c0c03eedbbc8fd99a0cd70aeaead7f8cc6f9bdbfe5de7d479b0132295685db9f11e83d732bcfcb5016738b41bcefcdee7398ee9d01da395751d624ec4171
-
Filesize
126B
MD5603910fc1f38e48a651cd9d8112be932
SHA176248fae7a6e0d61ee22a23f56133f6c13053c1d
SHA25627ee7d6062833a28351e8a9ef32cb1eea2954b02c299fd11e53391f7acccf475
SHA51256dedc06e65c39dbc4f28be4ac19b35d8ff1f046b6b1454d98a2250c8fe595540e7ba2c5604249cbc732dbe2821392bf771c3db543261d4c92ff92bb37d3394b
-
Filesize
195B
MD55c7b92f6b87ecc4a20bdf7cfd29a0cf7
SHA12d7707b93a955af070be8818fa748ad1aebd9384
SHA2563b07346df481abbc6fa93d22cd3f58c6d6744c824b21480c3b59c65667708518
SHA5120d5c499c7f2c3781a054b4d53ec389a27b36860c0f07a2a0d560c4c9f573dc57068d4876851f7e9ca6d46c4aaed5f8cf05c549744d08bc556f90f9647b95f13f
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
870B
MD5635353984f38d466aae0017f160e8b98
SHA1b38a94173bddf093c7371008cc6d8a842bb07a64
SHA25641f1c62ae84de930bc81279fd72bdafbd2f7626d3acda896243e5ba0d39af85a
SHA51201d2227b4ad3dc88866500a72d5fb5f68fe18eda56eedcb3fac3ad70243fec5d37857e233b00df0c08678f9d351c361875780d4b405b6f98d56d0fc894f380bd