Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe
Resource
win10v2004-20240802-en
General
-
Target
1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe
-
Size
540KB
-
MD5
5f892efbbce2a28d2c358c7b47b9d444
-
SHA1
7ab014e42aa490e4c26e8f4b3020b7bb8295dc1c
-
SHA256
1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648
-
SHA512
5bbbc771b7a35fa5083a82ee65dcaa0f8f7beb7d76f39897c47537a4e90eb7a0138f3b722e2364347fd4942cc77db89444cdedbe1c51ca84850030f358600d93
-
SSDEEP
12288:xHaXEVCo4QGycLS+9bPw9xBBgBbskxo0QEl1ayB6qfm:xHaQCo4Qn+9bPw9xclxxxlI4Xf
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7308504158:AAGvjg5ZWkkItSzfmQZs_qu73xKZ_gWVkJI/sendMessage?chat_id=6291749148
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
185.252.232.158:7812
64.23.232.116:7812
vsvf
-
delay
1
-
install
true
-
install_file
Windows Security Health Service.exe
-
install_folder
%AppData%
Extracted
xworm
5.0
185.252.232.158:7812
b0c5WZixE6SqaTDD
-
Install_directory
%AppData%
-
install_file
Windows Defender Security Service.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x00080000000164d0-23.dat family_xworm behavioral1/memory/2936-25-0x00000000009E0000-0x00000000009F0000-memory.dmp family_xworm -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 2 IoCs
resource yara_rule behavioral1/files/0x00080000000161fd-14.dat family_stormkitty behavioral1/memory/2804-28-0x0000000000A80000-0x0000000000AB0000-memory.dmp family_stormkitty -
Async RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x00080000000161fd-14.dat family_asyncrat behavioral1/files/0x000900000001631e-17.dat family_asyncrat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender Security Service.lnk Microsoft .NET Assembly Registration Utility.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender Security Service.lnk Microsoft .NET Assembly Registration Utility.exe -
Executes dropped EXE 5 IoCs
pid Process 2732 crack.exe 2804 svchost.exe 2656 Cracked.exe 2936 Microsoft .NET Assembly Registration Utility.exe 2320 Windows Security Health Service.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security Service = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender Security Service.exe" Microsoft .NET Assembly Registration Utility.exe -
Drops desktop.ini file(s) 7 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\2a50f61150c8b2067ab22c22c8449d62\Admin@PSBQWFYT_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\2a50f61150c8b2067ab22c22c8449d62\Admin@PSBQWFYT_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Local\2a50f61150c8b2067ab22c22c8449d62\Admin@PSBQWFYT_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Local\2a50f61150c8b2067ab22c22c8449d62\Admin@PSBQWFYT_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\2a50f61150c8b2067ab22c22c8449d62\Admin@PSBQWFYT_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Local\2a50f61150c8b2067ab22c22c8449d62\Admin@PSBQWFYT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\2a50f61150c8b2067ab22c22c8449d62\Admin@PSBQWFYT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2408 cmd.exe 3004 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier svchost.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 1776 timeout.exe 2844 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2304 schtasks.exe 872 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2936 Microsoft .NET Assembly Registration Utility.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2656 Cracked.exe 2656 Cracked.exe 2656 Cracked.exe 2656 Cracked.exe 2656 Cracked.exe 2656 Cracked.exe 2936 Microsoft .NET Assembly Registration Utility.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2804 svchost.exe 2804 svchost.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2804 svchost.exe 2804 svchost.exe 2320 Windows Security Health Service.exe 2804 svchost.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe 2320 Windows Security Health Service.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2936 Microsoft .NET Assembly Registration Utility.exe Token: SeDebugPrivilege 2656 Cracked.exe Token: SeDebugPrivilege 2804 svchost.exe Token: SeDebugPrivilege 2732 crack.exe Token: SeDebugPrivilege 2656 Cracked.exe Token: SeDebugPrivilege 2320 Windows Security Health Service.exe Token: SeDebugPrivilege 2320 Windows Security Health Service.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2936 Microsoft .NET Assembly Registration Utility.exe 2320 Windows Security Health Service.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2732 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 30 PID 2708 wrote to memory of 2732 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 30 PID 2708 wrote to memory of 2732 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 30 PID 2708 wrote to memory of 2732 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 30 PID 2708 wrote to memory of 2804 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 31 PID 2708 wrote to memory of 2804 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 31 PID 2708 wrote to memory of 2804 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 31 PID 2708 wrote to memory of 2804 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 31 PID 2708 wrote to memory of 2656 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 32 PID 2708 wrote to memory of 2656 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 32 PID 2708 wrote to memory of 2656 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 32 PID 2708 wrote to memory of 2936 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 33 PID 2708 wrote to memory of 2936 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 33 PID 2708 wrote to memory of 2936 2708 1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe 33 PID 2656 wrote to memory of 3040 2656 Cracked.exe 34 PID 2656 wrote to memory of 3040 2656 Cracked.exe 34 PID 2656 wrote to memory of 3040 2656 Cracked.exe 34 PID 2656 wrote to memory of 2592 2656 Cracked.exe 36 PID 2656 wrote to memory of 2592 2656 Cracked.exe 36 PID 2656 wrote to memory of 2592 2656 Cracked.exe 36 PID 3040 wrote to memory of 872 3040 cmd.exe 38 PID 3040 wrote to memory of 872 3040 cmd.exe 38 PID 3040 wrote to memory of 872 3040 cmd.exe 38 PID 2592 wrote to memory of 1776 2592 cmd.exe 39 PID 2592 wrote to memory of 1776 2592 cmd.exe 39 PID 2592 wrote to memory of 1776 2592 cmd.exe 39 PID 2936 wrote to memory of 2304 2936 Microsoft .NET Assembly Registration Utility.exe 41 PID 2936 wrote to memory of 2304 2936 Microsoft .NET Assembly Registration Utility.exe 41 PID 2936 wrote to memory of 2304 2936 Microsoft .NET Assembly Registration Utility.exe 41 PID 2732 wrote to memory of 2152 2732 crack.exe 43 PID 2732 wrote to memory of 2152 2732 crack.exe 43 PID 2732 wrote to memory of 2152 2732 crack.exe 43 PID 2732 wrote to memory of 2152 2732 crack.exe 43 PID 2152 wrote to memory of 2844 2152 cmd.exe 45 PID 2152 wrote to memory of 2844 2152 cmd.exe 45 PID 2152 wrote to memory of 2844 2152 cmd.exe 45 PID 2152 wrote to memory of 2844 2152 cmd.exe 45 PID 2592 wrote to memory of 2320 2592 cmd.exe 46 PID 2592 wrote to memory of 2320 2592 cmd.exe 46 PID 2592 wrote to memory of 2320 2592 cmd.exe 46 PID 2804 wrote to memory of 2408 2804 svchost.exe 47 PID 2804 wrote to memory of 2408 2804 svchost.exe 47 PID 2804 wrote to memory of 2408 2804 svchost.exe 47 PID 2804 wrote to memory of 2408 2804 svchost.exe 47 PID 2408 wrote to memory of 1948 2408 cmd.exe 49 PID 2408 wrote to memory of 1948 2408 cmd.exe 49 PID 2408 wrote to memory of 1948 2408 cmd.exe 49 PID 2408 wrote to memory of 1948 2408 cmd.exe 49 PID 2408 wrote to memory of 3004 2408 cmd.exe 50 PID 2408 wrote to memory of 3004 2408 cmd.exe 50 PID 2408 wrote to memory of 3004 2408 cmd.exe 50 PID 2408 wrote to memory of 3004 2408 cmd.exe 50 PID 2408 wrote to memory of 3056 2408 cmd.exe 51 PID 2408 wrote to memory of 3056 2408 cmd.exe 51 PID 2408 wrote to memory of 3056 2408 cmd.exe 51 PID 2408 wrote to memory of 3056 2408 cmd.exe 51 PID 2804 wrote to memory of 580 2804 svchost.exe 52 PID 2804 wrote to memory of 580 2804 svchost.exe 52 PID 2804 wrote to memory of 580 2804 svchost.exe 52 PID 2804 wrote to memory of 580 2804 svchost.exe 52 PID 580 wrote to memory of 1076 580 cmd.exe 54 PID 580 wrote to memory of 1076 580 cmd.exe 54 PID 580 wrote to memory of 1076 580 cmd.exe 54 PID 580 wrote to memory of 1076 580 cmd.exe 54 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe"C:\Users\Admin\AppData\Local\Temp\1229ffe79bd02279c46b45bb6766bcd02854656208b5a5a1fc3fa254c7790648.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Roaming\crack.exe"C:\Users\Admin\AppData\Roaming\crack.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6171.tmp.cmd""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\timeout.exetimeout 44⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2844
-
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3004
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵
- System Location Discovery: System Language Discovery
PID:3056
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
PID:1076
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:740
-
-
-
-
C:\Users\Admin\AppData\Roaming\Cracked.exe"C:\Users\Admin\AppData\Roaming\Cracked.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Security Health Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Security Health Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"'4⤵
- Scheduled Task/Job: Scheduled Task
PID:872
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp585D.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:1776
-
-
C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2320
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft .NET Assembly Registration Utility.exe"C:\Users\Admin\AppData\Roaming\Microsoft .NET Assembly Registration Utility.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Defender Security Service" /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2304
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {6A187E41-8EA5-40C6-A99D-60DA6079F8BF} S-1-5-21-3502430532-24693940-2469786940-1000:PSBQWFYT\Admin:Interactive:[1]1⤵PID:2512
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
175B
MD52a945486e44e0baf34412d768daeafcd
SHA17db673ee185b352a858bd4999a3eed6ec550cafa
SHA2562db23ad0c8181368ed0eb21ef85d3f1ac14c7447c152aa3c38b4464dcdd58785
SHA512ed0f0cafcf51e63940f198124f1e55069178b0987883b1edf48783a96eb63f92d14c60fc73cf1dc0d2082f093e0b4faa3ed8e44700ee85f10594f13ce324cb78
-
Filesize
151B
MD5db9cff8b430c59bacf295cc5885d12d0
SHA181e260f32b55b5f1d0ce2e1cdffdd782a3418a6a
SHA256ca391e14e95abfa9132fe4b29c7a0f0319bc8ce300fe82bbd395c9d9da58264a
SHA512968492b727150a7ed46b261032b8a6117e91c293e583b9077bfd49a89844a154e502a26de0ed520bc22771222a2558afd166cae97be7a07c865dc06eb1cc40ae
-
Filesize
74KB
MD50dfa83a82f6418c73406d78296de61be
SHA1dd7eceef8a434c43e0751e180bf714e08771d336
SHA2568d27369ffa8b29d561fa9daf485be14d2fc00287bb1c69d4c84d514891c8db5e
SHA5129a4b026250b18c29ab7dd48203f321c2ef2f12695bd2dcb52ebbc15001c8ddf019d5a7e04da056c50c1881ce269d1810259bf6d04b61f471e8751b7192fc73d4
-
Filesize
42KB
MD57a5ea6a11fdb03f789a2246aa8ff1501
SHA15e1289096418c7f8b5901963c34c89f9902cbbba
SHA256bde45f854d6c434717ea7b59587e020c2403123728c49deb56cba8132de5e96a
SHA512cfca94f3d78675bbe56f02119e3943f7067898d7b7d14e91bca7220a235665363f69930acdeb9f7df388a49a6b62812bcf74bbffad20a96915257b54c4e78a73
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
8KB
MD59215015740c937980b6b53cee5087769
SHA1a0bfe95486944f1548620d4de472c3758e95d36a
SHA256a5390a297f14ef8f5be308009ec436d2a58598188dbb92d7299795a10ba1c541
SHA5125b9bbf1836466d803d3e160a38e10c8397aa3966c120ab6435a52b7d0a09eb664ef2172bf0e7e2de1cc3eae261167c9355fa7ac3b1b7e4504a7e07b82c4b90e2
-
Filesize
170KB
MD56cbe3de085baa7ffcc6194a34746538a
SHA1986e6523294c5d3835af38a56c03239ca0f3a007
SHA2561aad9660ae1dcfada6ea39fc441f1b06fdab9b7fd71b71342f006e2d779cdf8b
SHA51250d73b171adb7dbf12f00267ea3501a676f757980a0ab6ba3ae64f7ca1666394dbb008b80faa51beecd9546e224425df4c48d08c0dbf69915ed07eda04e8aeeb