Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 02:23
Behavioral task
behavioral1
Sample
Vanta Paid.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
Vanta Paid.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
27 signatures
300 seconds
General
-
Target
Vanta Paid.exe
-
Size
165KB
-
MD5
dee04dfb6b2dd1b73a5c6b83911c4bed
-
SHA1
a80516d112d08fc820ddaaf6e6e972c088a2dfe2
-
SHA256
09bfb2b9045773f123de5aad102a6cc08bbad620b7cd35fa926b624ef1e7ee30
-
SHA512
209734045eb5efb01a0527db8bd74ebc027f3922b1c0c2caaa9eaa1e0043b22aa5c5845629d97aff698eb13ead2b111ff9a7d05df37ddd5e4e014f2426733c23
-
SSDEEP
3072:Fw19/9Arq7DWCKoXiO4VIaGEcPkGmK9LxBbqp2h2q:FwEwyxvcMGmCBbIq
Score
10/10
Malware Config
Signatures
-
Njrat family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupHelper.exe StartupHelper.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupHelper.exe StartupHelper.exe -
Executes dropped EXE 6 IoCs
pid Process 2944 StartupHelper.exe 2720 StartupHelper.exe 828 StartupHelper.exe 1720 StartupHelper.exe 2852 StartupHelper.exe 536 StartupHelper.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\StartupHelper.exe = "\"C:\\Windows\\StartupHelper.exe\" .." StartupHelper.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartupHelper.exe = "\"C:\\Windows\\StartupHelper.exe\" .." StartupHelper.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\StartupHelper.exe StartupHelper.exe File created C:\Windows\StartupHelper.exe Vanta Paid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 35 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vanta Paid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2804 schtasks.exe 2432 schtasks.exe 316 schtasks.exe 2492 schtasks.exe 2436 schtasks.exe 1772 schtasks.exe 3036 schtasks.exe 2384 schtasks.exe 1028 schtasks.exe 2408 schtasks.exe 3044 schtasks.exe 1328 schtasks.exe 696 schtasks.exe 2176 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe 2500 Vanta Paid.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2500 Vanta Paid.exe Token: SeDebugPrivilege 2944 StartupHelper.exe Token: SeDebugPrivilege 2720 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: SeDebugPrivilege 828 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: SeDebugPrivilege 1720 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: SeDebugPrivilege 2852 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe Token: 33 2944 StartupHelper.exe Token: SeIncBasePriorityPrivilege 2944 StartupHelper.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1736 2500 Vanta Paid.exe 30 PID 2500 wrote to memory of 1736 2500 Vanta Paid.exe 30 PID 2500 wrote to memory of 1736 2500 Vanta Paid.exe 30 PID 2500 wrote to memory of 1736 2500 Vanta Paid.exe 30 PID 2500 wrote to memory of 2436 2500 Vanta Paid.exe 32 PID 2500 wrote to memory of 2436 2500 Vanta Paid.exe 32 PID 2500 wrote to memory of 2436 2500 Vanta Paid.exe 32 PID 2500 wrote to memory of 2436 2500 Vanta Paid.exe 32 PID 2500 wrote to memory of 2120 2500 Vanta Paid.exe 34 PID 2500 wrote to memory of 2120 2500 Vanta Paid.exe 34 PID 2500 wrote to memory of 2120 2500 Vanta Paid.exe 34 PID 2500 wrote to memory of 2120 2500 Vanta Paid.exe 34 PID 2500 wrote to memory of 2408 2500 Vanta Paid.exe 36 PID 2500 wrote to memory of 2408 2500 Vanta Paid.exe 36 PID 2500 wrote to memory of 2408 2500 Vanta Paid.exe 36 PID 2500 wrote to memory of 2408 2500 Vanta Paid.exe 36 PID 2500 wrote to memory of 2944 2500 Vanta Paid.exe 38 PID 2500 wrote to memory of 2944 2500 Vanta Paid.exe 38 PID 2500 wrote to memory of 2944 2500 Vanta Paid.exe 38 PID 2500 wrote to memory of 2944 2500 Vanta Paid.exe 38 PID 2944 wrote to memory of 2676 2944 StartupHelper.exe 39 PID 2944 wrote to memory of 2676 2944 StartupHelper.exe 39 PID 2944 wrote to memory of 2676 2944 StartupHelper.exe 39 PID 2944 wrote to memory of 2676 2944 StartupHelper.exe 39 PID 2944 wrote to memory of 1772 2944 StartupHelper.exe 41 PID 2944 wrote to memory of 1772 2944 StartupHelper.exe 41 PID 2944 wrote to memory of 1772 2944 StartupHelper.exe 41 PID 2944 wrote to memory of 1772 2944 StartupHelper.exe 41 PID 2944 wrote to memory of 2704 2944 StartupHelper.exe 43 PID 2944 wrote to memory of 2704 2944 StartupHelper.exe 43 PID 2944 wrote to memory of 2704 2944 StartupHelper.exe 43 PID 2944 wrote to memory of 2704 2944 StartupHelper.exe 43 PID 2944 wrote to memory of 2804 2944 StartupHelper.exe 45 PID 2944 wrote to memory of 2804 2944 StartupHelper.exe 45 PID 2944 wrote to memory of 2804 2944 StartupHelper.exe 45 PID 2944 wrote to memory of 2804 2944 StartupHelper.exe 45 PID 2732 wrote to memory of 2720 2732 taskeng.exe 48 PID 2732 wrote to memory of 2720 2732 taskeng.exe 48 PID 2732 wrote to memory of 2720 2732 taskeng.exe 48 PID 2732 wrote to memory of 2720 2732 taskeng.exe 48 PID 2720 wrote to memory of 1996 2720 StartupHelper.exe 49 PID 2720 wrote to memory of 1996 2720 StartupHelper.exe 49 PID 2720 wrote to memory of 1996 2720 StartupHelper.exe 49 PID 2720 wrote to memory of 1996 2720 StartupHelper.exe 49 PID 2720 wrote to memory of 3044 2720 StartupHelper.exe 51 PID 2720 wrote to memory of 3044 2720 StartupHelper.exe 51 PID 2720 wrote to memory of 3044 2720 StartupHelper.exe 51 PID 2720 wrote to memory of 3044 2720 StartupHelper.exe 51 PID 2720 wrote to memory of 784 2720 StartupHelper.exe 53 PID 2720 wrote to memory of 784 2720 StartupHelper.exe 53 PID 2720 wrote to memory of 784 2720 StartupHelper.exe 53 PID 2720 wrote to memory of 784 2720 StartupHelper.exe 53 PID 2720 wrote to memory of 2492 2720 StartupHelper.exe 55 PID 2720 wrote to memory of 2492 2720 StartupHelper.exe 55 PID 2720 wrote to memory of 2492 2720 StartupHelper.exe 55 PID 2720 wrote to memory of 2492 2720 StartupHelper.exe 55 PID 2732 wrote to memory of 828 2732 taskeng.exe 59 PID 2732 wrote to memory of 828 2732 taskeng.exe 59 PID 2732 wrote to memory of 828 2732 taskeng.exe 59 PID 2732 wrote to memory of 828 2732 taskeng.exe 59 PID 828 wrote to memory of 2056 828 StartupHelper.exe 60 PID 828 wrote to memory of 2056 828 StartupHelper.exe 60 PID 828 wrote to memory of 2056 828 StartupHelper.exe 60 PID 828 wrote to memory of 2056 828 StartupHelper.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vanta Paid.exe"C:\Users\Admin\AppData\Local\Temp\Vanta Paid.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:1736
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\Vanta Paid.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2436
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:2120
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Vanta Paid.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2408
-
-
C:\Windows\StartupHelper.exe"C:\Windows\StartupHelper.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:2676
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1772
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2804
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {74A0196D-0A6F-4991-806E-0BA523451CD2} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:1996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3044
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:784
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2492
-
-
-
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:2056
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1328
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:960
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:696
-
-
-
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:2004
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2432
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:2168
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2176
-
-
-
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:2532
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3036
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:2580
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:316
-
-
-
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:2064
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:1672
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1028
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165KB
MD5dee04dfb6b2dd1b73a5c6b83911c4bed
SHA1a80516d112d08fc820ddaaf6e6e972c088a2dfe2
SHA25609bfb2b9045773f123de5aad102a6cc08bbad620b7cd35fa926b624ef1e7ee30
SHA512209734045eb5efb01a0527db8bd74ebc027f3922b1c0c2caaa9eaa1e0043b22aa5c5845629d97aff698eb13ead2b111ff9a7d05df37ddd5e4e014f2426733c23