Analysis
-
max time kernel
147s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 06:54
Static task
static1
Behavioral task
behavioral1
Sample
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
23b270add7b30a413a1b0d8047cb8570
-
SHA1
8ebd82ba85376d1108820112238134237f3a2fbd
-
SHA256
c67427d1f7af3ad23965b88e84c0d4b78b30145eeee25450ca82ba7f22dac700
-
SHA512
5b5b75f71cb46f00f9572843a8781a25cde92ca7f3bc043a6af58c153b1c4efabd8ebffaf620f45cb73304713fa740b2333def89f864118b83d1efe1c16ba55b
-
SSDEEP
24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e4:ObCjPKNqQEfsw43qtmVfq4p
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.me.com - Port:
587 - Username:
[email protected] - Password:
RICHARD205lord
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
jhdfkldfhndfkjdfnbfklfnf.exepid process 5072 jhdfkldfhndfkjdfnbfklfnf.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1560-15-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/1560-17-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/1560-16-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/1560-24-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral2/memory/3972-27-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3972-28-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3972-29-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral2/memory/3972-31-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
cvtres.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts cvtres.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" jhdfkldfhndfkjdfnbfklfnf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 31 icanhazip.com 33 ipinfo.io -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
jhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exedescription pid process target process PID 5072 set thread context of 4476 5072 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 4476 set thread context of 1560 4476 RegAsm.exe cvtres.exe PID 4476 set thread context of 3972 4476 RegAsm.exe cvtres.exe PID 4476 set thread context of 1288 4476 RegAsm.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 26 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3636 schtasks.exe 1324 schtasks.exe 2432 schtasks.exe 1824 schtasks.exe 1748 schtasks.exe 5076 schtasks.exe 232 schtasks.exe 4336 schtasks.exe 2800 schtasks.exe 2996 schtasks.exe 208 schtasks.exe 3448 schtasks.exe 4572 schtasks.exe 3700 schtasks.exe 4576 schtasks.exe 4824 schtasks.exe 4556 schtasks.exe 2832 schtasks.exe 5064 schtasks.exe 5076 schtasks.exe 828 schtasks.exe 2844 schtasks.exe 4036 schtasks.exe 2432 schtasks.exe 2496 schtasks.exe 4100 schtasks.exe -
NTFS ADS 2 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe:Zone.Identifier:$DATA 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe File created C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA jhdfkldfhndfkjdfnbfklfnf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exepid process 1112 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe 1112 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 4476 RegAsm.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe 5072 jhdfkldfhndfkjdfnbfklfnf.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegAsm.execvtres.execvtres.execvtres.exedescription pid process Token: SeDebugPrivilege 4476 RegAsm.exe Token: SeDebugPrivilege 1560 cvtres.exe Token: SeDebugPrivilege 3972 cvtres.exe Token: SeDebugPrivilege 1288 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 4476 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exejhdfkldfhndfkjdfnbfklfnf.exeRegAsm.exedescription pid process target process PID 1112 wrote to memory of 5072 1112 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 1112 wrote to memory of 5072 1112 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 1112 wrote to memory of 5072 1112 23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe jhdfkldfhndfkjdfnbfklfnf.exe PID 5072 wrote to memory of 4476 5072 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 5072 wrote to memory of 4476 5072 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 5072 wrote to memory of 4476 5072 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 5072 wrote to memory of 4476 5072 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 5072 wrote to memory of 4476 5072 jhdfkldfhndfkjdfnbfklfnf.exe RegAsm.exe PID 5072 wrote to memory of 4556 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 4556 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 4556 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 4476 wrote to memory of 1560 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1560 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1560 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1560 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1560 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1560 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1560 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 3972 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 3972 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 3972 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 3972 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 3972 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 3972 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 3972 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1288 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1288 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1288 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1288 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1288 4476 RegAsm.exe cvtres.exe PID 4476 wrote to memory of 1288 4476 RegAsm.exe cvtres.exe PID 5072 wrote to memory of 3448 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 3448 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 3448 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 232 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 232 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 232 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 2844 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 2844 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 2844 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 2800 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 2800 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 2800 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 4572 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 4572 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 4572 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 3700 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 3700 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 3700 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 1824 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 1824 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 1824 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 3636 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 3636 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 3636 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 5064 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 5064 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 5064 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 5076 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 5076 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 5076 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 4100 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 4100 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe PID 5072 wrote to memory of 4100 5072 jhdfkldfhndfkjdfnbfklfnf.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23b270add7b30a413a1b0d8047cb8570_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeC:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp47F1.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp4AD0.tmp"4⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp4B6E.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeFilesize
2.6MB
MD5c1af592d825f7c61ace1fa46f92446da
SHA19c73d2426523535d6b44e98d5d08516acad25d02
SHA2562f62fe99a16f3ceaccd4779cec1e9f49c843d173cbdf13e6c46a5095b9ff886f
SHA51244f8ae0405090963f17e7dc3438207803a59bb4b3484fd6feb9d92d46e3e6ba2b73ec22b9d9b38805297ca030a8532ca8da20930093294d91379ecd939572c32
-
C:\Users\Admin\AppData\Local\Temp\tmp47F1.tmpFilesize
1KB
MD5b0cc2e6f2d8036c9b5fef218736fa9c9
SHA164fd3017625979c95ba09d7cbea201010a82f73f
SHA256997aceeb78143e057d4ea0ed699db3cc1c723f699b4532663b7b85c83baa5c50
SHA512a1fe80b2971c4d1141a594f27eaea61500bf701cd1b8fbdb5ac2204a63c8ef862344f8c30f65ce769f0acf2b0718ed33a02744dd1a152c4a62a5318333d29b9b
-
C:\Users\Admin\AppData\Local\Temp\tmp4AD0.tmpFilesize
400B
MD5de4e5ff058882957cf8a3b5f839a031f
SHA10b3d8279120fb5fa27efbd9eee89695aa040fc24
SHA256ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49
SHA512a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72
-
C:\Users\Admin\AppData\Local\Temp\tmp4B6E.tmpFilesize
391B
MD53525ea58bba48993ea0d01b65ea71381
SHA11b917678fdd969e5ee5916e5899e7c75a979cf4d
SHA256681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2
SHA5125aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986
-
memory/1288-38-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1288-36-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1288-35-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1560-17-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1560-24-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1560-16-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1560-15-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/3972-27-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/3972-28-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/3972-29-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/3972-31-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/4476-10-0x0000000073BD0000-0x0000000074181000-memory.dmpFilesize
5.7MB
-
memory/4476-9-0x0000000073BD2000-0x0000000073BD3000-memory.dmpFilesize
4KB
-
memory/4476-8-0x0000000000700000-0x00000000007CA000-memory.dmpFilesize
808KB
-
memory/4476-42-0x0000000073BD2000-0x0000000073BD3000-memory.dmpFilesize
4KB
-
memory/4476-46-0x0000000073BD0000-0x0000000074181000-memory.dmpFilesize
5.7MB