njrat | a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe
Size 8.7MB
Sample240623-cap2vayfkj
SHA256 a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933
MD5 f4b88fcae631815e20d77fbbadfc06f8
SHA1 78a4b7e72df9f653f2efc0a6dea997f8a17d7a98
SHA512 9b556c922300a0b0d8cd2ada8e38ac0410d98bbde93ec68dcadd242225adf5dd90210495dd28012d480cb780586d246c6897bdd817d7a3933e4ed8ed25c123fc
SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb2:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat jjj evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

youri.mooo.com:1605

Mutex

e936a10f968ac948cd351c9629dbd36d

Attributes

reg_key
e936a10f968ac948cd351c9629dbd36d
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3524	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
3556	winmgr107.exe
2640	winmgr107.exe
780	winmgr107.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe"	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe"	winmgr107.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00080000000233ec-9.dat	autoit_exe
behavioral2/files/0x00070000000233ea-11.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3556 set thread context of 1912	3556	winmgr107.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File created	C:\Users\Admin\AppData\Local\Temp\a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe:Zone.Identifier:$DATA	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4420	schtasks.exe
552	schtasks.exe
3104	schtasks.exe
1860	schtasks.exe
1068	schtasks.exe
2104	schtasks.exe
3884	schtasks.exe
2104	schtasks.exe
220	schtasks.exe
2804	schtasks.exe
2756	schtasks.exe
5000	schtasks.exe
644	schtasks.exe
3412	schtasks.exe
2620	schtasks.exe
3496	schtasks.exe
2436	schtasks.exe
3132	schtasks.exe
1468	schtasks.exe
440	schtasks.exe
2248	schtasks.exe
2276	schtasks.exe
2396	schtasks.exe
3748	schtasks.exe
4116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
988	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe
988	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
2640	winmgr107.exe
2640	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
780	winmgr107.exe
780	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe
3556	winmgr107.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe
Token: 33	1912	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1912	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 60	988	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe	81
PID 988 wrote to memory of 60	988	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe	81
PID 988 wrote to memory of 60	988	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe	81
PID 60 wrote to memory of 4264	60	cmd.exe	83
PID 60 wrote to memory of 4264	60	cmd.exe	83
PID 60 wrote to memory of 4264	60	cmd.exe	83
PID 988 wrote to memory of 3556	988	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe	84
PID 988 wrote to memory of 3556	988	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe	84
PID 988 wrote to memory of 3556	988	a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe	84
PID 3556 wrote to memory of 1912	3556	winmgr107.exe	85
PID 3556 wrote to memory of 1912	3556	winmgr107.exe	85
PID 3556 wrote to memory of 1912	3556	winmgr107.exe	85
PID 3556 wrote to memory of 1912	3556	winmgr107.exe	85
PID 3556 wrote to memory of 1912	3556	winmgr107.exe	85
PID 3556 wrote to memory of 2276	3556	winmgr107.exe	86
PID 3556 wrote to memory of 2276	3556	winmgr107.exe	86
PID 3556 wrote to memory of 2276	3556	winmgr107.exe	86
PID 3556 wrote to memory of 440	3556	winmgr107.exe	90
PID 3556 wrote to memory of 440	3556	winmgr107.exe	90
PID 3556 wrote to memory of 440	3556	winmgr107.exe	90
PID 1912 wrote to memory of 3524	1912	RegAsm.exe	92
PID 1912 wrote to memory of 3524	1912	RegAsm.exe	92
PID 1912 wrote to memory of 3524	1912	RegAsm.exe	92
PID 3556 wrote to memory of 2104	3556	winmgr107.exe	94
PID 3556 wrote to memory of 2104	3556	winmgr107.exe	94
PID 3556 wrote to memory of 2104	3556	winmgr107.exe	94
PID 3556 wrote to memory of 1068	3556	winmgr107.exe	96
PID 3556 wrote to memory of 1068	3556	winmgr107.exe	96
PID 3556 wrote to memory of 1068	3556	winmgr107.exe	96
PID 3556 wrote to memory of 2248	3556	winmgr107.exe	101
PID 3556 wrote to memory of 2248	3556	winmgr107.exe	101
PID 3556 wrote to memory of 2248	3556	winmgr107.exe	101
PID 3556 wrote to memory of 2396	3556	winmgr107.exe	105
PID 3556 wrote to memory of 2396	3556	winmgr107.exe	105
PID 3556 wrote to memory of 2396	3556	winmgr107.exe	105
PID 3556 wrote to memory of 2804	3556	winmgr107.exe	107
PID 3556 wrote to memory of 2804	3556	winmgr107.exe	107
PID 3556 wrote to memory of 2804	3556	winmgr107.exe	107
PID 3556 wrote to memory of 2756	3556	winmgr107.exe	109
PID 3556 wrote to memory of 2756	3556	winmgr107.exe	109
PID 3556 wrote to memory of 2756	3556	winmgr107.exe	109
PID 3556 wrote to memory of 2436	3556	winmgr107.exe	111
PID 3556 wrote to memory of 2436	3556	winmgr107.exe	111
PID 3556 wrote to memory of 2436	3556	winmgr107.exe	111
PID 3556 wrote to memory of 5000	3556	winmgr107.exe	113
PID 3556 wrote to memory of 5000	3556	winmgr107.exe	113
PID 3556 wrote to memory of 5000	3556	winmgr107.exe	113
PID 3556 wrote to memory of 3748	3556	winmgr107.exe	115
PID 3556 wrote to memory of 3748	3556	winmgr107.exe	115
PID 3556 wrote to memory of 3748	3556	winmgr107.exe	115
PID 3556 wrote to memory of 644	3556	winmgr107.exe	118
PID 3556 wrote to memory of 644	3556	winmgr107.exe	118
PID 3556 wrote to memory of 644	3556	winmgr107.exe	118
PID 3556 wrote to memory of 3412	3556	winmgr107.exe	120
PID 3556 wrote to memory of 3412	3556	winmgr107.exe	120
PID 3556 wrote to memory of 3412	3556	winmgr107.exe	120
PID 3556 wrote to memory of 4420	3556	winmgr107.exe	122
PID 3556 wrote to memory of 4420	3556	winmgr107.exe	122
PID 3556 wrote to memory of 4420	3556	winmgr107.exe	122
PID 3556 wrote to memory of 3884	3556	winmgr107.exe	124
PID 3556 wrote to memory of 3884	3556	winmgr107.exe	124
PID 3556 wrote to memory of 3884	3556	winmgr107.exe	124
PID 3556 wrote to memory of 2620	3556	winmgr107.exe	126
PID 3556 wrote to memory of 2620	3556	winmgr107.exe	126

C:\Users\Admin\AppData\Local\Temp\a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe
"C:\Users\Admin\AppData\Local\Temp\a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe"
1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\PROGRA~3\A788AC~1.TXT
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe.txt
    3⤵
    PID:4264
- C:\ProgramData\winmgr107.exe
  C:\ProgramData\winmgr107.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3524
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2276
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:440
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1068
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2396
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2756
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2436
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3748
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:644
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3412
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3884
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2620
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:552
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3496
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3132
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3104
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:220
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1860
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1468

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2640

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe.txt

Path C:\PROGRA~3\a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe.txt
Size 992B
SHA256 78bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0
MD5 c8cf7247d4cfc99a7582a42d13df4c08
SHA1 317f5588af0b3b6374c436fb00084c522fd78a83
SHA512 5dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357
MD5 SHA1 SHA512

Submit Download

winmgr107.exe

Path C:\ProgramData\winmgr107.exe
Size 8.7MB
SHA256 a3e5bf7603ea350e2427182cee07162cbcdc72f659c4885b479c7be84dfc817c
MD5 95fc3afbe56cab596bdf829e65c18590
SHA1 d8a02f0a93236089c987de12be668a61d01adf99
SHA512 aa2e1e436c66e02e03f66edde51567c965411c6014f1fb3d2e7681801fa68381716bb63dfd717cacd905b77945b810708f9681b03e49109740da241fc82f1ac4
SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbV:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmB
MD5 SHA1 SHA512 SSDEEP

Submit Download

a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe

Path C:\Users\Admin\AppData\Local\Temp\a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933.exe
Size 8.7MB
SHA256 a788acbbb15e7a2b98774b6961828ad381548f3aaa0ae9a0f8afbde6533b1933
MD5 f4b88fcae631815e20d77fbbadfc06f8
SHA1 78a4b7e72df9f653f2efc0a6dea997f8a17d7a98
SHA512 9b556c922300a0b0d8cd2ada8e38ac0410d98bbde93ec68dcadd242225adf5dd90210495dd28012d480cb780586d246c6897bdd817d7a3933e4ed8ed25c123fc
SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb2:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1912-15-0x0000000001030000-0x000000000103C000-memory.dmp

Download