Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-01-2025 13:53
Behavioral task
behavioral1
Sample
8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
Behavioral task
behavioral2
Sample
8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe
-
Size
164KB
-
MD5
76485dba8f2c2080ea17c6fc2f548b6f
-
SHA1
744386e47e4b2d2145b842d055c6807e7286b7eb
-
SHA256
8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64
-
SHA512
1113b2843c829a0c7e493c4a4291e1f29fad58dbcb1814328060af659bc4ff81b5a4c0a80a17c96556cbfb1d74bea4349499741a96a43cdc6473fc1e87995896
-
SSDEEP
3072:Z64O/PtrrCkAhs5JKOGY5EOQPwiwXbMLRidIZC1AR:Z6IOunwXbMAdMCyR
Score
7/10
Malware Config
Signatures
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe -
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Kills process with taskkill 6 IoCs
pid Process 1320 TASKKILL.exe 2720 TASKKILL.exe 2708 TASKKILL.exe 2268 TASKKILL.exe 1996 TASKKILL.exe 720 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1624 schtasks.exe 1688 schtasks.exe 2764 schtasks.exe 2820 schtasks.exe 2452 schtasks.exe 2252 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe Token: SeDebugPrivilege 2708 TASKKILL.exe Token: SeDebugPrivilege 2720 TASKKILL.exe Token: SeDebugPrivilege 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe Token: SeDebugPrivilege 1996 TASKKILL.exe Token: SeDebugPrivilege 2268 TASKKILL.exe Token: SeDebugPrivilege 720 TASKKILL.exe Token: SeDebugPrivilege 548 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe Token: SeDebugPrivilege 1320 TASKKILL.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 2732 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 30 PID 1524 wrote to memory of 2732 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 30 PID 1524 wrote to memory of 2732 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 30 PID 1524 wrote to memory of 2732 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 30 PID 1524 wrote to memory of 2820 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 32 PID 1524 wrote to memory of 2820 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 32 PID 1524 wrote to memory of 2820 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 32 PID 1524 wrote to memory of 2820 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 32 PID 1524 wrote to memory of 2720 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 34 PID 1524 wrote to memory of 2720 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 34 PID 1524 wrote to memory of 2720 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 34 PID 1524 wrote to memory of 2720 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 34 PID 1524 wrote to memory of 2708 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 35 PID 1524 wrote to memory of 2708 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 35 PID 1524 wrote to memory of 2708 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 35 PID 1524 wrote to memory of 2708 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 35 PID 1524 wrote to memory of 1584 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 39 PID 1524 wrote to memory of 1584 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 39 PID 1524 wrote to memory of 1584 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 39 PID 1524 wrote to memory of 1584 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 39 PID 1524 wrote to memory of 2452 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 41 PID 1524 wrote to memory of 2452 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 41 PID 1524 wrote to memory of 2452 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 41 PID 1524 wrote to memory of 2452 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 41 PID 1524 wrote to memory of 1440 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 43 PID 1524 wrote to memory of 1440 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 43 PID 1524 wrote to memory of 1440 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 43 PID 1524 wrote to memory of 1440 1524 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 43 PID 1960 wrote to memory of 484 1960 taskeng.exe 45 PID 1960 wrote to memory of 484 1960 taskeng.exe 45 PID 1960 wrote to memory of 484 1960 taskeng.exe 45 PID 1960 wrote to memory of 484 1960 taskeng.exe 45 PID 484 wrote to memory of 908 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 46 PID 484 wrote to memory of 908 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 46 PID 484 wrote to memory of 908 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 46 PID 484 wrote to memory of 908 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 46 PID 484 wrote to memory of 2252 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 48 PID 484 wrote to memory of 2252 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 48 PID 484 wrote to memory of 2252 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 48 PID 484 wrote to memory of 2252 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 48 PID 484 wrote to memory of 2268 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 50 PID 484 wrote to memory of 2268 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 50 PID 484 wrote to memory of 2268 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 50 PID 484 wrote to memory of 2268 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 50 PID 484 wrote to memory of 1996 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 51 PID 484 wrote to memory of 1996 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 51 PID 484 wrote to memory of 1996 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 51 PID 484 wrote to memory of 1996 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 51 PID 484 wrote to memory of 2996 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 54 PID 484 wrote to memory of 2996 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 54 PID 484 wrote to memory of 2996 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 54 PID 484 wrote to memory of 2996 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 54 PID 484 wrote to memory of 1624 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 56 PID 484 wrote to memory of 1624 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 56 PID 484 wrote to memory of 1624 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 56 PID 484 wrote to memory of 1624 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 56 PID 484 wrote to memory of 1976 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 58 PID 484 wrote to memory of 1976 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 58 PID 484 wrote to memory of 1976 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 58 PID 484 wrote to memory of 1976 484 8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe 58 PID 1960 wrote to memory of 548 1960 taskeng.exe 60 PID 1960 wrote to memory of 548 1960 taskeng.exe 60 PID 1960 wrote to memory of 548 1960 taskeng.exe 60 PID 1960 wrote to memory of 548 1960 taskeng.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe"C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2820
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:1584
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2452
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 6122⤵
- System Location Discovery: System Language Discovery
PID:1440
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EF4C7C36-A80A-4A08-8510-8B80EA3F9F83} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exeC:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:908
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2252
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:2996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1624
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5763⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
-
C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exeC:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:548 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:856
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1688
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:720
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:2796
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\8f0fa7178c7220c23920b65c4c938f6edf28992d44e51687e3412edafabf2a64.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2764
-
-