Overview

overview

10

Static

static

3

0oj3.exe

windows7-x64

1

0oj3.exe

windows10-2004-x64

10

interception.dll

windows7-x64

1

interception.dll

windows10-2004-x64

1

libcrypto-3-x64.dll

windows7-x64

1

libcrypto-3-x64.dll

windows10-2004-x64

1

netlimiter....0.exe

windows7-x64

7

netlimiter....0.exe

windows10-2004-x64

7

onnxruntime.dll

windows7-x64

1

onnxruntime.dll

windows10-2004-x64

1

opencv_world490.dll

windows7-x64

1

opencv_world490.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 21:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0oj3.exe

  • Size

    37.0MB

  • MD5

    d57050cc8f1d71bb068a181301146855

  • SHA1

    564deb2344ea43dd519ee0000642cb0ced55da83

  • SHA256

    08058004805b7054e6dd6c55e1aebfa356cddd46167aae7de4322d4c3ae79db1

  • SHA512

    43af8130465347d06e23838bc652a94b8d06518d81c40f32f87d78d87a485ae23b13d7585f3e05f0231b9f6f59e383b98617b268519d1c6742b7309c1da494e4

  • SSDEEP

    786432:b/gO+cE2+qOnY9ZBLcf5jJGlbarkt0PAmyrL+rXrO37:bEcEGbLwjubcktYbO37

Score
10/10
asyncratserviceexecutionpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.6.1

Botnet

service

C2

193.57.137.78:5555

Mutex

Q8ghiNEV5vpA

Attributes
  • delay

    3

  • install

    true

  • install_file

    cmd.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 28 IoCs
  • Modifies registry class 11 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Executes dropped EXE
    PID:624
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      2⤵
        PID:788
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Executes dropped EXE
        PID:1020
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Executes dropped EXE
      PID:672
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:780
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:796
        • C:\Windows\system32\wbem\unsecapp.exe
          C:\Windows\system32\wbem\unsecapp.exe -Embedding
          2⤵
          • Executes dropped EXE
          PID:2884
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          2⤵
            PID:3752
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            2⤵
            • Executes dropped EXE
            PID:3856
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            2⤵
            • Executes dropped EXE
            PID:3920
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            2⤵
              PID:4000
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:3664
            • C:\Windows\system32\SppExtComObj.exe
              C:\Windows\system32\SppExtComObj.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:3764
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              2⤵
                PID:4276
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                2⤵
                • Executes dropped EXE
                PID:2412
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                2⤵
                • Executes dropped EXE
                PID:2000
              • C:\Windows\system32\wbem\wmiprvse.exe
                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                2⤵
                • Checks BIOS information in registry
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Checks processor information in registry
                • Enumerates system info in registry
                PID:1456
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                  PID:1972
                • C:\Windows\System32\mousocoreworker.exe
                  C:\Windows\System32\mousocoreworker.exe -Embedding
                  2⤵
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  PID:1640
                • C:\Windows\system32\backgroundTaskHost.exe
                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                  2⤵
                    PID:3704
                  • C:\Windows\system32\backgroundTaskHost.exe
                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                    2⤵
                    • Loads dropped DLL
                    PID:2008
                  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                    2⤵
                    • Loads dropped DLL
                    PID:1596
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k RPCSS -p
                  1⤵
                  • Executes dropped EXE
                  PID:896
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                  1⤵
                  • Executes dropped EXE
                  PID:956
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                  1⤵
                  • Executes dropped EXE
                  PID:392
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                  1⤵
                  • Executes dropped EXE
                  PID:992
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                  1⤵
                  • Executes dropped EXE
                  PID:1032
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                  • Executes dropped EXE
                  PID:1112
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1120
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  PID:1172
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                    • Executes dropped EXE
                    PID:776
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                  1⤵
                  • Executes dropped EXE
                  PID:1208
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1244
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1288
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                  1⤵
                  • Executes dropped EXE
                  PID:1352
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                  1⤵
                  • Executes dropped EXE
                  PID:1392
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    2⤵
                    • Executes dropped EXE
                    PID:3052
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                  1⤵
                  • Executes dropped EXE
                  PID:1520
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                  1⤵
                  • Executes dropped EXE
                  PID:1572
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                  1⤵
                  • Executes dropped EXE
                  PID:1584
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1660
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                  1⤵
                  • Executes dropped EXE
                  PID:1676
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                  1⤵
                  • Executes dropped EXE
                  PID:1736
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                  1⤵
                  • Executes dropped EXE
                  PID:1768
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                  1⤵
                  • Executes dropped EXE
                  PID:1820
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                  1⤵
                  • Executes dropped EXE
                  PID:1940
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                  1⤵
                  • Executes dropped EXE
                  PID:1948
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                  1⤵
                  • Executes dropped EXE
                  PID:1956
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                  1⤵
                  • Executes dropped EXE
                  PID:1656
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2068
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2092
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                  1⤵
                  • Executes dropped EXE
                  PID:2120
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                  1⤵
                  • Executes dropped EXE
                  PID:2188
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                  1⤵
                  • Executes dropped EXE
                  PID:2328
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                  1⤵
                  • Executes dropped EXE
                  PID:2436
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                  1⤵
                  • Executes dropped EXE
                  PID:2444
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  PID:2628
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2680
                • C:\Windows\sysmon.exe
                  C:\Windows\sysmon.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2696
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                  1⤵
                  • Executes dropped EXE
                  PID:2720
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                  1⤵
                  • Executes dropped EXE
                  PID:2740
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                  1⤵
                  • Executes dropped EXE
                  PID:2692
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                  1⤵
                  • Executes dropped EXE
                  PID:3172
                • C:\Windows\Explorer.EXE
                  C:\Windows\Explorer.EXE
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3344
                  • C:\Users\Admin\AppData\Local\Temp\0oj3.exe
                    "C:\Users\Admin\AppData\Local\Temp\0oj3.exe"
                    2⤵
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: RenamesItself
                    • Suspicious use of WriteProcessMemory
                    PID:1184
                    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                      cmd.exe
                      3⤵
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: RenamesItself
                      • Suspicious use of WriteProcessMemory
                      PID:1420
                      • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                        "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3256
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"' & exit
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4988
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"'
                            6⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:2564
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" create AutoRunService binPath="C:\Program Files\cmd.exe" type=own start=auto
                          5⤵
                          • Launches sc.exe
                          PID:2032
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" start AutoRunService
                          5⤵
                          • Launches sc.exe
                          PID:3180
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                  1⤵
                  • Executes dropped EXE
                  PID:3352
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                  • Executes dropped EXE
                  PID:3564
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                  1⤵
                  • Loads dropped DLL
                  • Modifies data under HKEY_USERS
                  PID:4748
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                  1⤵
                  • Executes dropped EXE
                  PID:4880
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                  1⤵
                  • Executes dropped EXE
                  PID:412
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:2204
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                  1⤵
                  • Executes dropped EXE
                  PID:2212
                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:1500
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                  1⤵
                  • Executes dropped EXE
                  PID:4512
                • C:\Windows\System32\WaaSMedicAgent.exe
                  C:\Windows\System32\WaaSMedicAgent.exe be6f929faf988ac154423d4d932f6bc2 PaMcIzbLLk6Z/NCE3DLGfg.0.1.0.0.0
                  1⤵
                  • Sets service image path in registry
                  PID:3100
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    2⤵
                    • Loads dropped DLL
                    PID:4460
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                  1⤵
                  • Loads dropped DLL
                  PID:448
                • C:\Program Files\cmd.exe
                  "C:\Program Files\cmd.exe"
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  PID:4208
                • C:\Windows\servicing\TrustedInstaller.exe
                  C:\Windows\servicing\TrustedInstaller.exe
                  1⤵
                  • Loads dropped DLL
                  PID:4132
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                  1⤵
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1304

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                System Services

                1
                T1569

                Service Execution

                1
                T1569.002

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Modify Registry

                2
                T1112

                Credential Access

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                6
                T1012

                System Information Discovery

                6
                T1082

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\cmd.exe
                  Filesize

                  1.9MB

                  MD5

                  5d864ba27836417dbbb494b3a5d888a9

                  SHA1

                  66b87eb33a31d18ac8c89d237c2235b80ecc1b79

                  SHA256

                  0f916874ee10e6b39afb2319eb33ee8f6b6d1b11f223ce859ead0b1375f84b36

                  SHA512

                  6f59639c1b1ec0f928347d2ec7da1c46a5b2c9ef3cff71d2e4ec8009b6a97ca0f033d27a830d4efd697f99982c2a86f6620cd9e392918756425223ca9caafdf6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                  Filesize

                  2.2MB

                  MD5

                  dd2b4161313175caffafa7fa4ee184c6

                  SHA1

                  e660e3063e7771425e1edfffc45d8387c090fb59

                  SHA256

                  c2572e03276acd9c8b641606eb123a304ddfcb1bab172706ce863b1102e42bf4

                  SHA512

                  ed567c0d9827969a66c43dd7c5ac552c18a4f7f4c9063cda30badceddb0397faa14dbef4bb7730b00dc78e55d6f05adc3c149e37a6517f944e4d179e1ae49ce0

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                  Filesize

                  2KB

                  MD5

                  8abf2d6067c6f3191a015f84aa9b6efe

                  SHA1

                  98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                  SHA256

                  ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                  SHA512

                  c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                  Filesize

                  2KB

                  MD5

                  f313c5b4f95605026428425586317353

                  SHA1

                  06be66fa06e1cffc54459c38d3d258f46669d01a

                  SHA256

                  129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                  SHA512

                  b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                  Filesize

                  2KB

                  MD5

                  ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                  SHA1

                  a3879621f9493414d497ea6d70fbf17e283d5c08

                  SHA256

                  98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                  SHA512

                  1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                  Filesize

                  2KB

                  MD5

                  7d612892b20e70250dbd00d0cdd4f09b

                  SHA1

                  63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                  SHA256

                  727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                  SHA512

                  f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                  Filesize

                  2KB

                  MD5

                  1e8e2076314d54dd72e7ee09ff8a52ab

                  SHA1

                  5fd0a67671430f66237f483eef39ff599b892272

                  SHA256

                  55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                  SHA512

                  5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                  Download Submit

                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                  Filesize

                  2KB

                  MD5

                  0b990e24f1e839462c0ac35fef1d119e

                  SHA1

                  9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                  SHA256

                  a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                  SHA512

                  c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                  Download Submit

                • C:\Windows\system32\ASChelp.dll
                  Filesize

                  112KB

                  MD5

                  6a0f36515a46c1a29da10d9aaf6c2193

                  SHA1

                  47f57d38c99d2e9d6cdbb8c8ef9da9eb2b9f6365

                  SHA256

                  ee45c3f9d8b46a1414a313b356c14ef728847072ad01791924eef53215f2e937

                  SHA512

                  3e33c23b2d0de819fa7cdde962c14934b14d81438f5df0b48e450a851ded2f03809ee80246241d8df2c8768f12a4176792f39808534fdbaea8d00cd41b3a6e02

                  Download Submit

                • memory/1184-0-0x00007FFCDA410000-0x00007FFCDA412000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/1184-6-0x00007FF74C5A0000-0x00007FF74D5A0000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/1184-2-0x00007FF74C5A0000-0x00007FF74D5A0000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/1184-1-0x00007FFCDA420000-0x00007FFCDA422000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/1420-19-0x00007FF74C5A0000-0x00007FF74D5A0000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/1420-18-0x00007FF74C5A0000-0x00007FF74D5A0000-memory.dmp

                  Filesize

                  16.0MB

                  Download

                • memory/3256-20-0x0000026FA1390000-0x0000026FA1396000-memory.dmp

                  Filesize

                  24KB

                  Download

                • memory/3256-17-0x0000026F9F5F0000-0x0000026F9F832000-memory.dmp

                  Filesize

                  2.3MB

                  Download

                • memory/3752-192-0x0000023EEF210000-0x0000023EEF218000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/4208-33-0x0000029C6CE80000-0x0000029C6D06C000-memory.dmp

                  Filesize

                  1.9MB

                  Download