Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe
Resource
win10v2004-20240802-en
General
-
Target
d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe
-
Size
8.7MB
-
MD5
a894de217e97df36a4dff83d67c561e0
-
SHA1
f8794dd1d0f26f007fe4a59f2c6d4d8f8e14cba0
-
SHA256
d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbb
-
SHA512
3c79acbd529d1f0e093dc2bdbb9ccbeacb9eda82c3b39503361321243035031e7eaf7c9ae95061b475713fad5a47cb37159bb3afb352a34e903767efee69129d
-
SSDEEP
196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbV:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmR
Malware Config
Extracted
njrat
0.7d
jjj
youri.mooo.com:1605
e936a10f968ac948cd351c9629dbd36d
-
reg_key
e936a10f968ac948cd351c9629dbd36d
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3444 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 4476 winmgr107.exe 3000 winmgr107.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" winmgr107.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a0000000234f2-12.dat autoit_exe behavioral2/files/0x00070000000234e5-10.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4476 set thread context of 2132 4476 winmgr107.exe 93 -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File created C:\Users\Admin\AppData\Local\Temp\d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe:Zone.Identifier:$DATA d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr107.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr107.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings cmd.exe -
NTFS ADS 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe:Zone.Identifier:$DATA d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe File created C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 19 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1972 schtasks.exe 5064 schtasks.exe 216 schtasks.exe 4104 schtasks.exe 3712 schtasks.exe 3260 schtasks.exe 100 schtasks.exe 1192 schtasks.exe 2296 schtasks.exe 1824 schtasks.exe 1268 schtasks.exe 2280 schtasks.exe 748 schtasks.exe 4972 schtasks.exe 3144 schtasks.exe 3996 schtasks.exe 2568 schtasks.exe 3424 schtasks.exe 932 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 468 d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe 468 d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 3000 winmgr107.exe 3000 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe 4476 winmgr107.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe Token: 33 2132 RegAsm.exe Token: SeIncBasePriorityPrivilege 2132 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 468 wrote to memory of 4784 468 d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe 89 PID 468 wrote to memory of 4784 468 d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe 89 PID 468 wrote to memory of 4784 468 d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe 89 PID 4784 wrote to memory of 2788 4784 cmd.exe 91 PID 4784 wrote to memory of 2788 4784 cmd.exe 91 PID 4784 wrote to memory of 2788 4784 cmd.exe 91 PID 468 wrote to memory of 4476 468 d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe 92 PID 468 wrote to memory of 4476 468 d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe 92 PID 468 wrote to memory of 4476 468 d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe 92 PID 4476 wrote to memory of 2132 4476 winmgr107.exe 93 PID 4476 wrote to memory of 2132 4476 winmgr107.exe 93 PID 4476 wrote to memory of 2132 4476 winmgr107.exe 93 PID 4476 wrote to memory of 2132 4476 winmgr107.exe 93 PID 4476 wrote to memory of 2132 4476 winmgr107.exe 93 PID 4476 wrote to memory of 1268 4476 winmgr107.exe 94 PID 4476 wrote to memory of 1268 4476 winmgr107.exe 94 PID 4476 wrote to memory of 1268 4476 winmgr107.exe 94 PID 4476 wrote to memory of 932 4476 winmgr107.exe 97 PID 4476 wrote to memory of 932 4476 winmgr107.exe 97 PID 4476 wrote to memory of 932 4476 winmgr107.exe 97 PID 2132 wrote to memory of 3444 2132 RegAsm.exe 100 PID 2132 wrote to memory of 3444 2132 RegAsm.exe 100 PID 2132 wrote to memory of 3444 2132 RegAsm.exe 100 PID 4476 wrote to memory of 2280 4476 winmgr107.exe 102 PID 4476 wrote to memory of 2280 4476 winmgr107.exe 102 PID 4476 wrote to memory of 2280 4476 winmgr107.exe 102 PID 4476 wrote to memory of 748 4476 winmgr107.exe 104 PID 4476 wrote to memory of 748 4476 winmgr107.exe 104 PID 4476 wrote to memory of 748 4476 winmgr107.exe 104 PID 4476 wrote to memory of 216 4476 winmgr107.exe 106 PID 4476 wrote to memory of 216 4476 winmgr107.exe 106 PID 4476 wrote to memory of 216 4476 winmgr107.exe 106 PID 4476 wrote to memory of 4972 4476 winmgr107.exe 108 PID 4476 wrote to memory of 4972 4476 winmgr107.exe 108 PID 4476 wrote to memory of 4972 4476 winmgr107.exe 108 PID 4476 wrote to memory of 1972 4476 winmgr107.exe 110 PID 4476 wrote to memory of 1972 4476 winmgr107.exe 110 PID 4476 wrote to memory of 1972 4476 winmgr107.exe 110 PID 4476 wrote to memory of 3260 4476 winmgr107.exe 112 PID 4476 wrote to memory of 3260 4476 winmgr107.exe 112 PID 4476 wrote to memory of 3260 4476 winmgr107.exe 112 PID 4476 wrote to memory of 3144 4476 winmgr107.exe 114 PID 4476 wrote to memory of 3144 4476 winmgr107.exe 114 PID 4476 wrote to memory of 3144 4476 winmgr107.exe 114 PID 4476 wrote to memory of 100 4476 winmgr107.exe 117 PID 4476 wrote to memory of 100 4476 winmgr107.exe 117 PID 4476 wrote to memory of 100 4476 winmgr107.exe 117 PID 4476 wrote to memory of 4104 4476 winmgr107.exe 119 PID 4476 wrote to memory of 4104 4476 winmgr107.exe 119 PID 4476 wrote to memory of 4104 4476 winmgr107.exe 119 PID 4476 wrote to memory of 3996 4476 winmgr107.exe 121 PID 4476 wrote to memory of 3996 4476 winmgr107.exe 121 PID 4476 wrote to memory of 3996 4476 winmgr107.exe 121 PID 4476 wrote to memory of 5064 4476 winmgr107.exe 123 PID 4476 wrote to memory of 5064 4476 winmgr107.exe 123 PID 4476 wrote to memory of 5064 4476 winmgr107.exe 123 PID 4476 wrote to memory of 3712 4476 winmgr107.exe 125 PID 4476 wrote to memory of 3712 4476 winmgr107.exe 125 PID 4476 wrote to memory of 3712 4476 winmgr107.exe 125 PID 4476 wrote to memory of 1192 4476 winmgr107.exe 127 PID 4476 wrote to memory of 1192 4476 winmgr107.exe 127 PID 4476 wrote to memory of 1192 4476 winmgr107.exe 127 PID 4476 wrote to memory of 2568 4476 winmgr107.exe 129 PID 4476 wrote to memory of 2568 4476 winmgr107.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe"C:\Users\Admin\AppData\Local\Temp\d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe"1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\PROGRA~3\D215B9~1.TXT2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe.txt3⤵
- System Location Discovery: System Language Discovery
PID:2788
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3444
-
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1268
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:932
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2280
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:748
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:216
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4972
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1972
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3260
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3144
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:100
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4104
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3996
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5064
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3712
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1192
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2568
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2296
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1824
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3424
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3000
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
992B
MD5c8cf7247d4cfc99a7582a42d13df4c08
SHA1317f5588af0b3b6374c436fb00084c522fd78a83
SHA25678bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0
SHA5125dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357
-
Filesize
8.7MB
MD50080621f448651d55be38a0487b3c37a
SHA1cab3dd8989028373d307fb4d54b42acdd41d0c80
SHA256053f4091bec10346d7f910914afac814f56a427881f499e2c6c464efb4559c3e
SHA512b1b11da6e57ec322853670b8d5e0f8396be50a732554009136c4bf35f666a5721a36d84eb8ef13e169de015ea282a6a01b91085f2b57cc2958f6d6dbf79e1b75
-
C:\Users\Admin\AppData\Local\Temp\d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbbN.exe
Filesize8.7MB
MD5a894de217e97df36a4dff83d67c561e0
SHA1f8794dd1d0f26f007fe4a59f2c6d4d8f8e14cba0
SHA256d215b98ea91deaa2cfcb95256b85e323d0feeb23825805e2226e23b5f9816bbb
SHA5123c79acbd529d1f0e093dc2bdbb9ccbeacb9eda82c3b39503361321243035031e7eaf7c9ae95061b475713fad5a47cb37159bb3afb352a34e903767efee69129d