Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
0790af2d17e7a0ab3cd907154b995300
-
SHA1
0852e1736b22c30a419a264ddc0e2a42e2096be1
-
SHA256
4519dcbdcb111511405abaf7d0b6bb7c12cbb865c02ddb2946304222f57717fe
-
SHA512
b59d3104a3f31f79e67f2c99b0f4c7e16a8063ce744934a8614d9678ae565ca5148db69fdc2e124678122dedc53e1bbf0b0ff21f7d52986e4d410c237c6477dc
-
SSDEEP
24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4ea:ObCjPKNqQEfsw43qtmVfq4L
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.me.com - Port:
587 - Username:
[email protected] - Password:
RICHARD205lord
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 712 jhdfkldfhndfkjdfnbfklfnf.exe 3184 winmgr119.exe 2444 winmgr119.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4008-15-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/4008-16-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/4008-17-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/4008-24-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/1896-27-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1896-28-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1896-29-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/1896-31-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts cvtres.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" 0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" jhdfkldfhndfkjdfnbfklfnf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 icanhazip.com 22 ipinfo.io -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0009000000023384-3.dat autoit_exe behavioral2/files/0x000700000002342f-42.dat autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 712 set thread context of 4156 712 jhdfkldfhndfkjdfnbfklfnf.exe 94 PID 4156 set thread context of 4008 4156 RegAsm.exe 97 PID 4156 set thread context of 1896 4156 RegAsm.exe 99 PID 4156 set thread context of 1744 4156 RegAsm.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 26 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2924 schtasks.exe 4852 schtasks.exe 3304 schtasks.exe 1288 schtasks.exe 4528 schtasks.exe 4020 schtasks.exe 2448 schtasks.exe 1668 schtasks.exe 4112 schtasks.exe 3872 schtasks.exe 1868 schtasks.exe 1376 schtasks.exe 1800 schtasks.exe 1608 schtasks.exe 5056 schtasks.exe 628 schtasks.exe 3156 schtasks.exe 4424 schtasks.exe 3752 schtasks.exe 4236 schtasks.exe 1620 schtasks.exe 1720 schtasks.exe 1912 schtasks.exe 4764 schtasks.exe 2056 schtasks.exe 2296 schtasks.exe -
NTFS ADS 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe:Zone.Identifier:$DATA 0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe File created C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA jhdfkldfhndfkjdfnbfklfnf.exe File created C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA winmgr119.exe File opened for modification C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA winmgr119.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1356 0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe 1356 0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 3184 winmgr119.exe 3184 winmgr119.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 712 jhdfkldfhndfkjdfnbfklfnf.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 4156 RegAsm.exe 2444 winmgr119.exe 2444 winmgr119.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4156 RegAsm.exe Token: SeDebugPrivilege 4008 cvtres.exe Token: SeDebugPrivilege 1896 cvtres.exe Token: SeDebugPrivilege 1744 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4156 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1356 wrote to memory of 712 1356 0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe 91 PID 1356 wrote to memory of 712 1356 0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe 91 PID 1356 wrote to memory of 712 1356 0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe 91 PID 712 wrote to memory of 4156 712 jhdfkldfhndfkjdfnbfklfnf.exe 94 PID 712 wrote to memory of 4156 712 jhdfkldfhndfkjdfnbfklfnf.exe 94 PID 712 wrote to memory of 4156 712 jhdfkldfhndfkjdfnbfklfnf.exe 94 PID 712 wrote to memory of 4156 712 jhdfkldfhndfkjdfnbfklfnf.exe 94 PID 712 wrote to memory of 4156 712 jhdfkldfhndfkjdfnbfklfnf.exe 94 PID 712 wrote to memory of 1620 712 jhdfkldfhndfkjdfnbfklfnf.exe 95 PID 712 wrote to memory of 1620 712 jhdfkldfhndfkjdfnbfklfnf.exe 95 PID 712 wrote to memory of 1620 712 jhdfkldfhndfkjdfnbfklfnf.exe 95 PID 4156 wrote to memory of 4008 4156 RegAsm.exe 97 PID 4156 wrote to memory of 4008 4156 RegAsm.exe 97 PID 4156 wrote to memory of 4008 4156 RegAsm.exe 97 PID 4156 wrote to memory of 4008 4156 RegAsm.exe 97 PID 4156 wrote to memory of 4008 4156 RegAsm.exe 97 PID 4156 wrote to memory of 4008 4156 RegAsm.exe 97 PID 4156 wrote to memory of 4008 4156 RegAsm.exe 97 PID 4156 wrote to memory of 1896 4156 RegAsm.exe 99 PID 4156 wrote to memory of 1896 4156 RegAsm.exe 99 PID 4156 wrote to memory of 1896 4156 RegAsm.exe 99 PID 4156 wrote to memory of 1896 4156 RegAsm.exe 99 PID 4156 wrote to memory of 1896 4156 RegAsm.exe 99 PID 4156 wrote to memory of 1896 4156 RegAsm.exe 99 PID 4156 wrote to memory of 1896 4156 RegAsm.exe 99 PID 4156 wrote to memory of 1744 4156 RegAsm.exe 101 PID 4156 wrote to memory of 1744 4156 RegAsm.exe 101 PID 4156 wrote to memory of 1744 4156 RegAsm.exe 101 PID 4156 wrote to memory of 1744 4156 RegAsm.exe 101 PID 4156 wrote to memory of 1744 4156 RegAsm.exe 101 PID 4156 wrote to memory of 1744 4156 RegAsm.exe 101 PID 712 wrote to memory of 1720 712 jhdfkldfhndfkjdfnbfklfnf.exe 103 PID 712 wrote to memory of 1720 712 jhdfkldfhndfkjdfnbfklfnf.exe 103 PID 712 wrote to memory of 1720 712 jhdfkldfhndfkjdfnbfklfnf.exe 103 PID 712 wrote to memory of 3752 712 jhdfkldfhndfkjdfnbfklfnf.exe 107 PID 712 wrote to memory of 3752 712 jhdfkldfhndfkjdfnbfklfnf.exe 107 PID 712 wrote to memory of 3752 712 jhdfkldfhndfkjdfnbfklfnf.exe 107 PID 712 wrote to memory of 1668 712 jhdfkldfhndfkjdfnbfklfnf.exe 109 PID 712 wrote to memory of 1668 712 jhdfkldfhndfkjdfnbfklfnf.exe 109 PID 712 wrote to memory of 1668 712 jhdfkldfhndfkjdfnbfklfnf.exe 109 PID 712 wrote to memory of 4020 712 jhdfkldfhndfkjdfnbfklfnf.exe 111 PID 712 wrote to memory of 4020 712 jhdfkldfhndfkjdfnbfklfnf.exe 111 PID 712 wrote to memory of 4020 712 jhdfkldfhndfkjdfnbfklfnf.exe 111 PID 712 wrote to memory of 2924 712 jhdfkldfhndfkjdfnbfklfnf.exe 113 PID 712 wrote to memory of 2924 712 jhdfkldfhndfkjdfnbfklfnf.exe 113 PID 712 wrote to memory of 2924 712 jhdfkldfhndfkjdfnbfklfnf.exe 113 PID 712 wrote to memory of 3872 712 jhdfkldfhndfkjdfnbfklfnf.exe 115 PID 712 wrote to memory of 3872 712 jhdfkldfhndfkjdfnbfklfnf.exe 115 PID 712 wrote to memory of 3872 712 jhdfkldfhndfkjdfnbfklfnf.exe 115 PID 712 wrote to memory of 2448 712 jhdfkldfhndfkjdfnbfklfnf.exe 117 PID 712 wrote to memory of 2448 712 jhdfkldfhndfkjdfnbfklfnf.exe 117 PID 712 wrote to memory of 2448 712 jhdfkldfhndfkjdfnbfklfnf.exe 117 PID 712 wrote to memory of 1912 712 jhdfkldfhndfkjdfnbfklfnf.exe 119 PID 712 wrote to memory of 1912 712 jhdfkldfhndfkjdfnbfklfnf.exe 119 PID 712 wrote to memory of 1912 712 jhdfkldfhndfkjdfnbfklfnf.exe 119 PID 712 wrote to memory of 1868 712 jhdfkldfhndfkjdfnbfklfnf.exe 121 PID 712 wrote to memory of 1868 712 jhdfkldfhndfkjdfnbfklfnf.exe 121 PID 712 wrote to memory of 1868 712 jhdfkldfhndfkjdfnbfklfnf.exe 121 PID 712 wrote to memory of 4852 712 jhdfkldfhndfkjdfnbfklfnf.exe 123 PID 712 wrote to memory of 4852 712 jhdfkldfhndfkjdfnbfklfnf.exe 123 PID 712 wrote to memory of 4852 712 jhdfkldfhndfkjdfnbfklfnf.exe 123 PID 712 wrote to memory of 1376 712 jhdfkldfhndfkjdfnbfklfnf.exe 125 PID 712 wrote to memory of 1376 712 jhdfkldfhndfkjdfnbfklfnf.exe 125 PID 712 wrote to memory of 1376 712 jhdfkldfhndfkjdfnbfklfnf.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeC:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9C5F.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9F00.tmp"4⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9F7E.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1620
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1720
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:3752
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1668
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:4020
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2924
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:3872
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2448
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1912
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1868
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:4852
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1376
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:4236
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:3304
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1288
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1608
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:5056
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:628
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:3156
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:4764
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:4112
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:4424
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1800
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2056
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2296
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:4528
-
-
-
C:\ProgramData\winmgr119.exeC:\ProgramData\winmgr119.exe1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3184
-
C:\ProgramData\winmgr119.exeC:\ProgramData\winmgr119.exe1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD564bfdbd592650c574706ed4b76a69bcb
SHA101e6ebb45208fdd4504a249f106b81becb338170
SHA2566b0105e36378632134641fe79f86dc12f85982aa781215807be6997c3f49b6ed
SHA512ebbd2a98d404827e5ea35274a4b56f86362de748360739986f2a742e23fc6610207f9b374deb608fc9aabd8bb7ebeb7d8d68bc8c4cc888a318687877fa4a4a61
-
Filesize
8B
MD59328e7a9a275f19fc438054ff184a8f6
SHA1de795634656fc0b28246146492ed3b386679aac8
SHA256af09189b1169c85d3447445bebeb31c9377fcffc6d5d7be7467f429d0318cca4
SHA51255697ae28580f2ddad8bfa24084662ce2943ae7e41f5ea1b1d1e07c445070f5ead7fe16977301448fdae02bc8b7236e6f03567100cf2d7fca17c0c708befeff9
-
Filesize
2.6MB
MD5f202ab12fcca165ed4721e327fb76ba5
SHA1a3586417a5f9b4f73de092aaeecc30aa89edbf74
SHA256ba88c97c06e729f2221839d3009f3e42f2f21cbacb027c317b35b2f6b59b6419
SHA512f93ad816fe1b93973bfadb23b5b60492f5034ba0b97265008286ef3e4fad8dc37e4a31646a5a3b23f83922bf999cb1e9178aa810563104f8c5b8777724b7a356
-
Filesize
1KB
MD5b0cc2e6f2d8036c9b5fef218736fa9c9
SHA164fd3017625979c95ba09d7cbea201010a82f73f
SHA256997aceeb78143e057d4ea0ed699db3cc1c723f699b4532663b7b85c83baa5c50
SHA512a1fe80b2971c4d1141a594f27eaea61500bf701cd1b8fbdb5ac2204a63c8ef862344f8c30f65ce769f0acf2b0718ed33a02744dd1a152c4a62a5318333d29b9b
-
Filesize
400B
MD5de4e5ff058882957cf8a3b5f839a031f
SHA10b3d8279120fb5fa27efbd9eee89695aa040fc24
SHA256ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49
SHA512a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72
-
Filesize
391B
MD53525ea58bba48993ea0d01b65ea71381
SHA11b917678fdd969e5ee5916e5899e7c75a979cf4d
SHA256681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2
SHA5125aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986