Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3099355d506...eb.exe
windows7-x64
10099355d506...eb.exe
windows10-2004-x64
1023d6f9a120...1e.exe
windows7-x64
823d6f9a120...1e.exe
windows10-2004-x64
83a9efda763...8a.exe
windows7-x64
103a9efda763...8a.exe
windows10-2004-x64
103b49b6c1cc...86.exe
windows7-x64
103b49b6c1cc...86.exe
windows10-2004-x64
104f8799e544...b7.exe
windows7-x64
104f8799e544...b7.exe
windows10-2004-x64
1051bd8c50dd...09.exe
windows7-x64
1051bd8c50dd...09.exe
windows10-2004-x64
1056b7b7798a...0e.exe
windows7-x64
1056b7b7798a...0e.exe
windows10-2004-x64
1057fb495954...9d.exe
windows7-x64
1057fb495954...9d.exe
windows10-2004-x64
105f278f8bde...cb.exe
windows7-x64
105f278f8bde...cb.exe
windows10-2004-x64
1066b157a3d4...e6.exe
windows7-x64
1066b157a3d4...e6.exe
windows10-2004-x64
106ec9f82a79...36.exe
windows7-x64
106ec9f82a79...36.exe
windows10-2004-x64
108d469fed80...33.exe
windows7-x64
108d469fed80...33.exe
windows10-2004-x64
10977e5ce44a...f1.exe
windows7-x64
10977e5ce44a...f1.exe
windows10-2004-x64
10a4865b2ed7...c6.exe
windows7-x64
10a4865b2ed7...c6.exe
windows10-2004-x64
10cbee3a2ab9...7f.exe
windows7-x64
10cbee3a2ab9...7f.exe
windows10-2004-x64
10cd3b81fbf9...1c.exe
windows7-x64
10cd3b81fbf9...1c.exe
windows10-2004-x64
10Resubmissions
12/03/2025, 21:32
250312-1dmynatxey 1011/03/2025, 16:10
250311-tmgdxaxnx4 1006/03/2025, 02:30
250306-cze8yav1az 10Analysis
-
max time kernel
135s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
099355d506f15966ba946cd6f58a72f6c02c73232349cf7f2d6af5641eed0ceb.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
099355d506f15966ba946cd6f58a72f6c02c73232349cf7f2d6af5641eed0ceb.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
23d6f9a120790d441377488f28c15f7ffc4df84c3fb5d05ce42f0bae5d75731e.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
23d6f9a120790d441377488f28c15f7ffc4df84c3fb5d05ce42f0bae5d75731e.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
3a9efda763f017e1ca8237aa27f8659b081f62f42e11aa36b6e122f65caca48a.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3a9efda763f017e1ca8237aa27f8659b081f62f42e11aa36b6e122f65caca48a.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral7
Sample
3b49b6c1cc92bed7fb10ec3399c1f03449c5ab983a7d03f22bd83392b7a2dc86.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3b49b6c1cc92bed7fb10ec3399c1f03449c5ab983a7d03f22bd83392b7a2dc86.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral9
Sample
4f8799e5441c553ebbda342b6b06356a70dc432e5ac0434f4158146520b57ab7.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
4f8799e5441c553ebbda342b6b06356a70dc432e5ac0434f4158146520b57ab7.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral11
Sample
51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral13
Sample
56b7b7798a01e1bad522a375b7b096efeba0e118885b353b525b44471cdec90e.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
56b7b7798a01e1bad522a375b7b096efeba0e118885b353b525b44471cdec90e.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral15
Sample
57fb4959548b3597ea3689167e496cdbb83d07afa9f0f3acb6a56987cd50099d.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
57fb4959548b3597ea3689167e496cdbb83d07afa9f0f3acb6a56987cd50099d.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral17
Sample
5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral19
Sample
66b157a3d414b913b1a436edc71e8fc733c1f5457302fe9ca950a8b16d86b9e6.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
66b157a3d414b913b1a436edc71e8fc733c1f5457302fe9ca950a8b16d86b9e6.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral21
Sample
6ec9f82a79152492b6a50a55dee43665e5205d607206573ce3729f824a05db36.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
6ec9f82a79152492b6a50a55dee43665e5205d607206573ce3729f824a05db36.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral23
Sample
8d469fed80fcd597d17e15df98cd15a4646abb69cd7f81795af94c2c46ed2a33.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
8d469fed80fcd597d17e15df98cd15a4646abb69cd7f81795af94c2c46ed2a33.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral25
Sample
977e5ce44a0ca0b374857f1f9ba476376ab41b7edf1117a3f5b805a69244f6f1.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
977e5ce44a0ca0b374857f1f9ba476376ab41b7edf1117a3f5b805a69244f6f1.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral27
Sample
a4865b2ed7dce154e50357674e8f15052a532609af0026dc4c8ea69b8a2f77c6.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
a4865b2ed7dce154e50357674e8f15052a532609af0026dc4c8ea69b8a2f77c6.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral29
Sample
cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral31
Sample
cd3b81fbf93281530341f8c8cd66cfdeb7b2f1ec04f6fbe68ddcc35d28200a1c.exe
Resource
win7-20240903-en
General
-
Target
51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe
-
Size
482KB
-
MD5
d5c6afc24d4fff226ae1190fde23e514
-
SHA1
e342136d49082c798e5da37f27a0bad894e3e4ce
-
SHA256
51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209
-
SHA512
4cfa0f5bacd1521792bc3278bd0b25871da1b86afc7e7a243b89cd2a7ccd7119ab013422c1cccad06790e2d5b3885180047684d5a3504d6a1f86ad42aba0a575
-
SSDEEP
12288:iCMnvQcYyer7in58R3wgG56gtIRQA/wpS:WvgyKG5c45ptIiA/wpS
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.boydsteamships.com - Port:
587 - Username:
[email protected] - Password:
co*tNjEBt4
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload 5 IoCs
resource yara_rule behavioral11/memory/2888-8-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral11/memory/2888-7-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral11/memory/2888-11-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral11/memory/2888-13-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral11/memory/2888-15-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Executes dropped EXE 4 IoCs
pid Process 2184 Jedu.exe 2296 Jedu.exe 1020 Jedu.exe 948 Jedu.exe -
Loads dropped DLL 2 IoCs
pid Process 2184 Jedu.exe 1020 Jedu.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2840 set thread context of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2184 set thread context of 2296 2184 Jedu.exe 38 PID 1020 set thread context of 948 1020 Jedu.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jedu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jedu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jedu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jedu.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2884 schtasks.exe 1128 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2888 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 2888 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 2296 Jedu.exe 2296 Jedu.exe 948 Jedu.exe 948 Jedu.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe Token: SeDebugPrivilege 2888 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe Token: SeDebugPrivilege 2184 Jedu.exe Token: SeDebugPrivilege 2296 Jedu.exe Token: SeDebugPrivilege 1020 Jedu.exe Token: SeDebugPrivilege 948 Jedu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 2888 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 29 PID 2840 wrote to memory of 1476 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 30 PID 2840 wrote to memory of 1476 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 30 PID 2840 wrote to memory of 1476 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 30 PID 2840 wrote to memory of 1476 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 30 PID 2840 wrote to memory of 2372 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 31 PID 2840 wrote to memory of 2372 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 31 PID 2840 wrote to memory of 2372 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 31 PID 2840 wrote to memory of 2372 2840 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe 31 PID 1476 wrote to memory of 2884 1476 cmd.exe 34 PID 1476 wrote to memory of 2884 1476 cmd.exe 34 PID 1476 wrote to memory of 2884 1476 cmd.exe 34 PID 1476 wrote to memory of 2884 1476 cmd.exe 34 PID 2692 wrote to memory of 2184 2692 taskeng.exe 37 PID 2692 wrote to memory of 2184 2692 taskeng.exe 37 PID 2692 wrote to memory of 2184 2692 taskeng.exe 37 PID 2692 wrote to memory of 2184 2692 taskeng.exe 37 PID 2692 wrote to memory of 2184 2692 taskeng.exe 37 PID 2692 wrote to memory of 2184 2692 taskeng.exe 37 PID 2692 wrote to memory of 2184 2692 taskeng.exe 37 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2184 wrote to memory of 2296 2184 Jedu.exe 38 PID 2692 wrote to memory of 1020 2692 taskeng.exe 39 PID 2692 wrote to memory of 1020 2692 taskeng.exe 39 PID 2692 wrote to memory of 1020 2692 taskeng.exe 39 PID 2692 wrote to memory of 1020 2692 taskeng.exe 39 PID 2692 wrote to memory of 1020 2692 taskeng.exe 39 PID 2692 wrote to memory of 1020 2692 taskeng.exe 39 PID 2692 wrote to memory of 1020 2692 taskeng.exe 39 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 948 1020 Jedu.exe 40 PID 1020 wrote to memory of 1552 1020 Jedu.exe 41 PID 1020 wrote to memory of 1552 1020 Jedu.exe 41 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe"C:\Users\Admin\AppData\Local\Temp\51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe"C:\Users\Admin\AppData\Local\Temp\51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2888
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2884
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe" "C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2372
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E76AB1AB-4524-439E-A4E5-79B74FBA32DF} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exeC:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe"C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
-
C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exeC:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe"C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe'" /f3⤵
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1128
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe" "C:\Users\Admin\AppData\Roaming\Jedu\Jedu.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2100
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
482KB
MD5d5c6afc24d4fff226ae1190fde23e514
SHA1e342136d49082c798e5da37f27a0bad894e3e4ce
SHA25651bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209
SHA5124cfa0f5bacd1521792bc3278bd0b25871da1b86afc7e7a243b89cd2a7ccd7119ab013422c1cccad06790e2d5b3885180047684d5a3504d6a1f86ad42aba0a575