njrat | aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe
Size 8.7MB
Sample240624-bj42pasdkh
SHA256 aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31
MD5 7b9dc13f5ebd5c859528e383ada44b7f
SHA1 0dfe4a3404766e92ea9a09915a5a7a45225bd5e4
SHA512 e0a8157dbc30af45f96b6fbf99784980182692ea554d44336ed08f5cedc5e4065b7d51be6d56dada9244acb170fc530525cf21037f027c93b625c407317af2fd
SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbx:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat jjj evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

youri.mooo.com:1605

Mutex

e936a10f968ac948cd351c9629dbd36d

Attributes

reg_key
e936a10f968ac948cd351c9629dbd36d
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3184	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1404	winmgr107.exe
3228	winmgr107.exe
4776	winmgr107.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe"	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe"	winmgr107.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0003000000000711-9.dat	autoit_exe
behavioral2/files/0x0007000000023427-11.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 3568	1404	winmgr107.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe:Zone.Identifier:$DATA	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe
File created	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe
File opened for modification	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2632	schtasks.exe
764	schtasks.exe
1652	schtasks.exe
4128	schtasks.exe
4420	schtasks.exe
4260	schtasks.exe
2488	schtasks.exe
4068	schtasks.exe
3876	schtasks.exe
1676	schtasks.exe
2076	schtasks.exe
1872	schtasks.exe
3508	schtasks.exe
1524	schtasks.exe
1672	schtasks.exe
1228	schtasks.exe
3684	schtasks.exe
3104	schtasks.exe
1788	schtasks.exe
956	schtasks.exe
392	schtasks.exe
3424	schtasks.exe
1000	schtasks.exe
3276	schtasks.exe
1484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4060	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe
4060	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
3228	winmgr107.exe
3228	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
4776	winmgr107.exe
4776	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe
1404	winmgr107.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe
Token: 33	3568	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3568	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4764	4060	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe	81
PID 4060 wrote to memory of 4764	4060	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe	81
PID 4060 wrote to memory of 4764	4060	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe	81
PID 4764 wrote to memory of 4852	4764	cmd.exe	83
PID 4764 wrote to memory of 4852	4764	cmd.exe	83
PID 4764 wrote to memory of 4852	4764	cmd.exe	83
PID 4060 wrote to memory of 1404	4060	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe	84
PID 4060 wrote to memory of 1404	4060	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe	84
PID 4060 wrote to memory of 1404	4060	aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe	84
PID 1404 wrote to memory of 3568	1404	winmgr107.exe	85
PID 1404 wrote to memory of 3568	1404	winmgr107.exe	85
PID 1404 wrote to memory of 3568	1404	winmgr107.exe	85
PID 1404 wrote to memory of 3568	1404	winmgr107.exe	85
PID 1404 wrote to memory of 3568	1404	winmgr107.exe	85
PID 1404 wrote to memory of 1000	1404	winmgr107.exe	86
PID 1404 wrote to memory of 1000	1404	winmgr107.exe	86
PID 1404 wrote to memory of 1000	1404	winmgr107.exe	86
PID 1404 wrote to memory of 2632	1404	winmgr107.exe	91
PID 1404 wrote to memory of 2632	1404	winmgr107.exe	91
PID 1404 wrote to memory of 2632	1404	winmgr107.exe	91
PID 3568 wrote to memory of 3184	3568	RegAsm.exe	93
PID 3568 wrote to memory of 3184	3568	RegAsm.exe	93
PID 3568 wrote to memory of 3184	3568	RegAsm.exe	93
PID 1404 wrote to memory of 3508	1404	winmgr107.exe	95
PID 1404 wrote to memory of 3508	1404	winmgr107.exe	95
PID 1404 wrote to memory of 3508	1404	winmgr107.exe	95
PID 1404 wrote to memory of 4068	1404	winmgr107.exe	97
PID 1404 wrote to memory of 4068	1404	winmgr107.exe	97
PID 1404 wrote to memory of 4068	1404	winmgr107.exe	97
PID 1404 wrote to memory of 764	1404	winmgr107.exe	103
PID 1404 wrote to memory of 764	1404	winmgr107.exe	103
PID 1404 wrote to memory of 764	1404	winmgr107.exe	103
PID 1404 wrote to memory of 1652	1404	winmgr107.exe	106
PID 1404 wrote to memory of 1652	1404	winmgr107.exe	106
PID 1404 wrote to memory of 1652	1404	winmgr107.exe	106
PID 1404 wrote to memory of 4128	1404	winmgr107.exe	108
PID 1404 wrote to memory of 4128	1404	winmgr107.exe	108
PID 1404 wrote to memory of 4128	1404	winmgr107.exe	108
PID 1404 wrote to memory of 1228	1404	winmgr107.exe	110
PID 1404 wrote to memory of 1228	1404	winmgr107.exe	110
PID 1404 wrote to memory of 1228	1404	winmgr107.exe	110
PID 1404 wrote to memory of 3104	1404	winmgr107.exe	112
PID 1404 wrote to memory of 3104	1404	winmgr107.exe	112
PID 1404 wrote to memory of 3104	1404	winmgr107.exe	112
PID 1404 wrote to memory of 3424	1404	winmgr107.exe	114
PID 1404 wrote to memory of 3424	1404	winmgr107.exe	114
PID 1404 wrote to memory of 3424	1404	winmgr107.exe	114
PID 1404 wrote to memory of 3876	1404	winmgr107.exe	116
PID 1404 wrote to memory of 3876	1404	winmgr107.exe	116
PID 1404 wrote to memory of 3876	1404	winmgr107.exe	116
PID 1404 wrote to memory of 1788	1404	winmgr107.exe	118
PID 1404 wrote to memory of 1788	1404	winmgr107.exe	118
PID 1404 wrote to memory of 1788	1404	winmgr107.exe	118
PID 1404 wrote to memory of 4420	1404	winmgr107.exe	120
PID 1404 wrote to memory of 4420	1404	winmgr107.exe	120
PID 1404 wrote to memory of 4420	1404	winmgr107.exe	120
PID 1404 wrote to memory of 1676	1404	winmgr107.exe	123
PID 1404 wrote to memory of 1676	1404	winmgr107.exe	123
PID 1404 wrote to memory of 1676	1404	winmgr107.exe	123
PID 1404 wrote to memory of 3684	1404	winmgr107.exe	125
PID 1404 wrote to memory of 3684	1404	winmgr107.exe	125
PID 1404 wrote to memory of 3684	1404	winmgr107.exe	125
PID 1404 wrote to memory of 956	1404	winmgr107.exe	127
PID 1404 wrote to memory of 956	1404	winmgr107.exe	127

C:\Users\Admin\AppData\Local\Temp\aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe
"C:\Users\Admin\AppData\Local\Temp\aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe"
1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\PROGRA~3\AA847F~1.TXT
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe.txt
    3⤵
    PID:4852
- C:\ProgramData\winmgr107.exe
  C:\ProgramData\winmgr107.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3184
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1000
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2632
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3508
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4068
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:764
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1652
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4128
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1228
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3104
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3424
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3876
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1788
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3684
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:956
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1524
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3276
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:392
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1672
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2076
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3228

C:\ProgramData\winmgr107.exe
C:\ProgramData\winmgr107.exe
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe.txt

Path C:\PROGRA~3\aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe.txt
Size 992B
SHA256 78bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0
MD5 c8cf7247d4cfc99a7582a42d13df4c08
SHA1 317f5588af0b3b6374c436fb00084c522fd78a83
SHA512 5dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357
MD5 SHA1 SHA512

Submit Download

winmgr107.exe

Path C:\ProgramData\winmgr107.exe
Size 8.7MB
SHA256 cadb53a18d97d73b25dc26e89221e64f3c122eb542d40231c8841b5dace8ef05
MD5 e214be3b8471ded60179a9c2bfce1af1
SHA1 852b6eda467605c23670bad064188a44ef4ca0c0
SHA512 e525bf58919ffb67acedde98f806e8dee1f9ef92c1b5b32a4552a28779486af6c71461d55028b5d6fec7d18fe562ea856dfefa9614ee5ef2f2a98e434fcd4902
SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbb:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmv
MD5 SHA1 SHA512 SSDEEP

Submit Download

aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe

Path C:\Users\Admin\AppData\Local\Temp\aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31.exe
Size 8.7MB
SHA256 aa847fcbe4abe165273c409de61fb686c551f06aea0030c454ea006b6890ec31
MD5 7b9dc13f5ebd5c859528e383ada44b7f
SHA1 0dfe4a3404766e92ea9a09915a5a7a45225bd5e4
SHA512 e0a8157dbc30af45f96b6fbf99784980182692ea554d44336ed08f5cedc5e4065b7d51be6d56dada9244acb170fc530525cf21037f027c93b625c407317af2fd
SSDEEP 196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbx:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3568-15-0x0000000000DA0000-0x0000000000DAC000-memory.dmp

Download