Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe
Resource
win10v2004-20241007-en
General
-
Target
bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe
-
Size
8.7MB
-
MD5
0d632dcfd9f9624f7fe121b90d76be4c
-
SHA1
1ab681579538b669573a2fffec2c08c6f017b23a
-
SHA256
bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832
-
SHA512
457e5e39e983deda59afed72195173dfaaac1f9a3cde7fdd535498216503bf5d5f91422bac364364cf5d05160f725a9ec2a47c95843cc69c65c60adf36db46ce
-
SSDEEP
196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCb2:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmi
Malware Config
Extracted
njrat
0.7d
jjj
youri.mooo.com:1605
e936a10f968ac948cd351c9629dbd36d
-
reg_key
e936a10f968ac948cd351c9629dbd36d
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1584 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 4 IoCs
pid Process 1996 winmgr107.exe 1524 winmgr107.exe 1328 winmgr107.exe 1408 winmgr107.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" winmgr107.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0011000000023b3d-9.dat autoit_exe behavioral2/files/0x0007000000023c8a-11.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1996 set thread context of 3556 1996 winmgr107.exe 102 -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File created C:\Users\Admin\AppData\Local\Temp\bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe:Zone.Identifier:$DATA bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 35 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr107.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr107.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr107.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr107.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings cmd.exe -
NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File created C:\Users\Admin\AppData\Local\Temp\bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe:Zone.Identifier:$DATA bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe File created C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 26 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4740 schtasks.exe 5032 schtasks.exe 4996 schtasks.exe 336 schtasks.exe 2000 schtasks.exe 4556 schtasks.exe 1592 schtasks.exe 4892 schtasks.exe 1476 schtasks.exe 2012 schtasks.exe 4648 schtasks.exe 2156 schtasks.exe 3696 schtasks.exe 3344 schtasks.exe 4228 schtasks.exe 4160 schtasks.exe 1968 schtasks.exe 1772 schtasks.exe 4080 schtasks.exe 4816 schtasks.exe 4936 schtasks.exe 5012 schtasks.exe 376 schtasks.exe 3944 schtasks.exe 1308 schtasks.exe 1548 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1128 bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe 1128 bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1524 winmgr107.exe 1524 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1328 winmgr107.exe 1328 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe 1408 winmgr107.exe 1408 winmgr107.exe 1996 winmgr107.exe 1996 winmgr107.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe Token: 33 3556 RegAsm.exe Token: SeIncBasePriorityPrivilege 3556 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1128 wrote to memory of 3928 1128 bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe 95 PID 1128 wrote to memory of 3928 1128 bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe 95 PID 1128 wrote to memory of 3928 1128 bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe 95 PID 3928 wrote to memory of 1500 3928 cmd.exe 98 PID 3928 wrote to memory of 1500 3928 cmd.exe 98 PID 3928 wrote to memory of 1500 3928 cmd.exe 98 PID 1128 wrote to memory of 1996 1128 bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe 101 PID 1128 wrote to memory of 1996 1128 bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe 101 PID 1128 wrote to memory of 1996 1128 bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe 101 PID 1996 wrote to memory of 3556 1996 winmgr107.exe 102 PID 1996 wrote to memory of 3556 1996 winmgr107.exe 102 PID 1996 wrote to memory of 3556 1996 winmgr107.exe 102 PID 1996 wrote to memory of 3556 1996 winmgr107.exe 102 PID 1996 wrote to memory of 3556 1996 winmgr107.exe 102 PID 1996 wrote to memory of 1772 1996 winmgr107.exe 103 PID 1996 wrote to memory of 1772 1996 winmgr107.exe 103 PID 1996 wrote to memory of 1772 1996 winmgr107.exe 103 PID 1996 wrote to memory of 1592 1996 winmgr107.exe 106 PID 1996 wrote to memory of 1592 1996 winmgr107.exe 106 PID 1996 wrote to memory of 1592 1996 winmgr107.exe 106 PID 3556 wrote to memory of 1584 3556 RegAsm.exe 109 PID 3556 wrote to memory of 1584 3556 RegAsm.exe 109 PID 3556 wrote to memory of 1584 3556 RegAsm.exe 109 PID 1996 wrote to memory of 4648 1996 winmgr107.exe 113 PID 1996 wrote to memory of 4648 1996 winmgr107.exe 113 PID 1996 wrote to memory of 4648 1996 winmgr107.exe 113 PID 1996 wrote to memory of 4740 1996 winmgr107.exe 116 PID 1996 wrote to memory of 4740 1996 winmgr107.exe 116 PID 1996 wrote to memory of 4740 1996 winmgr107.exe 116 PID 1996 wrote to memory of 5032 1996 winmgr107.exe 118 PID 1996 wrote to memory of 5032 1996 winmgr107.exe 118 PID 1996 wrote to memory of 5032 1996 winmgr107.exe 118 PID 1996 wrote to memory of 4892 1996 winmgr107.exe 120 PID 1996 wrote to memory of 4892 1996 winmgr107.exe 120 PID 1996 wrote to memory of 4892 1996 winmgr107.exe 120 PID 1996 wrote to memory of 4080 1996 winmgr107.exe 122 PID 1996 wrote to memory of 4080 1996 winmgr107.exe 122 PID 1996 wrote to memory of 4080 1996 winmgr107.exe 122 PID 1996 wrote to memory of 4996 1996 winmgr107.exe 124 PID 1996 wrote to memory of 4996 1996 winmgr107.exe 124 PID 1996 wrote to memory of 4996 1996 winmgr107.exe 124 PID 1996 wrote to memory of 4816 1996 winmgr107.exe 126 PID 1996 wrote to memory of 4816 1996 winmgr107.exe 126 PID 1996 wrote to memory of 4816 1996 winmgr107.exe 126 PID 1996 wrote to memory of 336 1996 winmgr107.exe 128 PID 1996 wrote to memory of 336 1996 winmgr107.exe 128 PID 1996 wrote to memory of 336 1996 winmgr107.exe 128 PID 1996 wrote to memory of 2156 1996 winmgr107.exe 130 PID 1996 wrote to memory of 2156 1996 winmgr107.exe 130 PID 1996 wrote to memory of 2156 1996 winmgr107.exe 130 PID 1996 wrote to memory of 1476 1996 winmgr107.exe 132 PID 1996 wrote to memory of 1476 1996 winmgr107.exe 132 PID 1996 wrote to memory of 1476 1996 winmgr107.exe 132 PID 1996 wrote to memory of 3696 1996 winmgr107.exe 134 PID 1996 wrote to memory of 3696 1996 winmgr107.exe 134 PID 1996 wrote to memory of 3696 1996 winmgr107.exe 134 PID 1996 wrote to memory of 3344 1996 winmgr107.exe 137 PID 1996 wrote to memory of 3344 1996 winmgr107.exe 137 PID 1996 wrote to memory of 3344 1996 winmgr107.exe 137 PID 1996 wrote to memory of 4936 1996 winmgr107.exe 139 PID 1996 wrote to memory of 4936 1996 winmgr107.exe 139 PID 1996 wrote to memory of 4936 1996 winmgr107.exe 139 PID 1996 wrote to memory of 5012 1996 winmgr107.exe 141 PID 1996 wrote to memory of 5012 1996 winmgr107.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe"C:\Users\Admin\AppData\Local\Temp\bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe"1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\PROGRA~3\BFE0DE~1.TXT2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe.txt3⤵
- System Location Discovery: System Language Discovery
PID:1500
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1584
-
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1772
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1592
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4648
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4740
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5032
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4892
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4080
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4996
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4816
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:336
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2156
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1476
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3696
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3344
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4936
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5012
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2000
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4228
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4160
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:376
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3944
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1308
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1548
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4556
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2012
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1968
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1524
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1328
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1408
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
992B
MD5c8cf7247d4cfc99a7582a42d13df4c08
SHA1317f5588af0b3b6374c436fb00084c522fd78a83
SHA25678bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0
SHA5125dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357
-
Filesize
8.7MB
MD546962ad1106b1393c8ca7e989382ae03
SHA1d9593048b02b693444c1154f88d50d09457d2546
SHA2563358fac7b071c1a48bd820431e0b4fcc875fc87a98084e728b424eb5c3454cc2
SHA512257f00be8005106ea727a7132efa40cbfe2303a82b19dec77eb986e0d595654f2effe739edf28c1ad9782ef69585e73ef38d3f629dc10dd5a42df715255d3c73
-
C:\Users\Admin\AppData\Local\Temp\bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832.exe
Filesize8.7MB
MD50d632dcfd9f9624f7fe121b90d76be4c
SHA11ab681579538b669573a2fffec2c08c6f017b23a
SHA256bfe0deac3ef53a5fbbd492a6e48174df4e82f1b4bbcc25728646ea07ebb9d832
SHA512457e5e39e983deda59afed72195173dfaaac1f9a3cde7fdd535498216503bf5d5f91422bac364364cf5d05160f725a9ec2a47c95843cc69c65c60adf36db46ce