Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10bca3772529...45.exe
windows7-x64
10bca3772529...45.exe
windows10-2004-x64
10bccb34575f...72.exe
windows7-x64
10bccb34575f...72.exe
windows10-2004-x64
10bcf1af9a5a...be.exe
windows7-x64
10bcf1af9a5a...be.exe
windows10-2004-x64
8bcf783e363...97.exe
windows7-x64
3bcf783e363...97.exe
windows10-2004-x64
3bd515574dc...8c.exe
windows7-x64
1bd515574dc...8c.exe
windows10-2004-x64
1bd68ca7605...39.exe
windows7-x64
10bd68ca7605...39.exe
windows10-2004-x64
10bd707a0357...e3.exe
windows7-x64
9bd707a0357...e3.exe
windows10-2004-x64
9bd7edfedeb...0b.exe
windows7-x64
10bd7edfedeb...0b.exe
windows10-2004-x64
10bdad1ff46d...f2.exe
windows7-x64
10bdad1ff46d...f2.exe
windows10-2004-x64
10bdae9ff159...df.exe
windows7-x64
10bdae9ff159...df.exe
windows10-2004-x64
10be01d2552c...1c.exe
windows7-x64
10be01d2552c...1c.exe
windows10-2004-x64
10be077774c9...87.exe
windows7-x64
10be077774c9...87.exe
windows10-2004-x64
10be0a8aeb7e...56.exe
windows7-x64
3be0a8aeb7e...56.exe
windows10-2004-x64
3be1643898c...f5.exe
windows7-x64
7be1643898c...f5.exe
windows10-2004-x64
10be183db6d4...94.exe
windows7-x64
10be183db6d4...94.exe
windows10-2004-x64
10be2375e810...94.exe
windows7-x64
10be2375e810...94.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:15
Behavioral task
behavioral1
Sample
bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
bccb34575fb2db34d4a29075cb2f9aa39904b7d5412695545f2240c00fbb0472.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
bccb34575fb2db34d4a29075cb2f9aa39904b7d5412695545f2240c00fbb0472.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
bcf1af9a5a93ae74ea1c79da9951c5be.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
bcf1af9a5a93ae74ea1c79da9951c5be.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
bcf783e363557f5bdd4014c159ae2497.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
bcf783e363557f5bdd4014c159ae2497.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
bd515574dc1cb379674710f110e907d8cd72a5e4c5eb90d464fbee847b71718c.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
bd515574dc1cb379674710f110e907d8cd72a5e4c5eb90d464fbee847b71718c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
bd68ca7605316450c87b9218d2dbe19d8c5694e07b93f320f3ca4a9ad902c139.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
bd68ca7605316450c87b9218d2dbe19d8c5694e07b93f320f3ca4a9ad902c139.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
bd707a0357b19ea6953d47900bb051e3.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
bd707a0357b19ea6953d47900bb051e3.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral15
Sample
bd7edfedebe8a680d801ffd5b2415cd3877e95c78edb8cfc44eaae3e0e9a1e0b.exe
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
bd7edfedebe8a680d801ffd5b2415cd3877e95c78edb8cfc44eaae3e0e9a1e0b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
bdad1ff46d46963cc687d5f6889c9ef2.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
bdad1ff46d46963cc687d5f6889c9ef2.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
bdae9ff15952ccdfec0be80562f1cbdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
bdae9ff15952ccdfec0be80562f1cbdf.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
be01d2552c64422f1b97721af2e07451309244c21e464bbe47b603043d95b21c.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
be01d2552c64422f1b97721af2e07451309244c21e464bbe47b603043d95b21c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
be077774c9e78bbe8c9388aa7d552de77e9ef40ec732ea193da049a0db2e5787.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
be077774c9e78bbe8c9388aa7d552de77e9ef40ec732ea193da049a0db2e5787.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
be0a8aeb7e1655bee6255bac9c2947ecef511b5f00e29933dfd9c7f39965bf56.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
be0a8aeb7e1655bee6255bac9c2947ecef511b5f00e29933dfd9c7f39965bf56.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
be1643898cf51a24e38e4044d24ae1f5.exe
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
be1643898cf51a24e38e4044d24ae1f5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
be183db6d4b77c092496c69c3f389b94.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
be183db6d4b77c092496c69c3f389b94.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe
Resource
win10v2004-20250314-en
General
-
Target
bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe
-
Size
561KB
-
MD5
009ad4da2328c0133ceddef2fd3687b4
-
SHA1
4b9ebbc512c4be235a29f3851afce645fba415b6
-
SHA256
bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445
-
SHA512
767b621b3295d71a511f26a2b8ee15a48f35eff75156e4947dd5ac1fdd13ce228fdac0042bdd44f3a411bd3927d5d8543e6864c0be672b52d8ed01d8d0d86311
-
SSDEEP
6144:QYodYSZydQTu2CFk0IkPyW//ne6VlWT8b9Qf+tbSaowwabqutYSUR8z:QYodYSZ+WcIpWXPVle8FPFt
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\GoogleChrome-CacheCookieFile.exe" bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Windows\\GoogleChrome-CacheCookieFile.exe" bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 62 IoCs
flow ioc 22 pastebin.com 26 pastebin.com 44 pastebin.com 45 pastebin.com 49 pastebin.com 56 pastebin.com 29 pastebin.com 53 pastebin.com 54 pastebin.com 14 pastebin.com 21 pastebin.com 27 pastebin.com 28 pastebin.com 35 pastebin.com 40 pastebin.com 67 pastebin.com 20 pastebin.com 31 pastebin.com 50 pastebin.com 57 pastebin.com 18 pastebin.com 19 pastebin.com 60 pastebin.com 65 pastebin.com 6 pastebin.com 17 pastebin.com 52 pastebin.com 58 pastebin.com 64 pastebin.com 32 pastebin.com 23 pastebin.com 36 pastebin.com 38 pastebin.com 51 pastebin.com 61 pastebin.com 63 pastebin.com 16 pastebin.com 33 pastebin.com 37 pastebin.com 43 pastebin.com 46 pastebin.com 66 pastebin.com 68 pastebin.com 47 pastebin.com 59 pastebin.com 4 pastebin.com 7 pastebin.com 9 pastebin.com 24 pastebin.com 25 pastebin.com 42 pastebin.com 55 pastebin.com 62 pastebin.com 8 pastebin.com 15 pastebin.com 48 pastebin.com 34 pastebin.com 30 pastebin.com 39 pastebin.com 41 pastebin.com 5 pastebin.com 10 pastebin.com -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GoogleChrome-CacheCookieFile.exe bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe File opened for modification C:\Windows\GoogleChrome-CacheCookieFile.exe bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe File created C:\Windows\xdwd.dll bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 43 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1444 schtasks.exe 2052 schtasks.exe 280 schtasks.exe 2024 schtasks.exe 2412 schtasks.exe 1456 schtasks.exe 356 schtasks.exe 1232 schtasks.exe 2272 schtasks.exe 1644 schtasks.exe 2444 schtasks.exe 320 schtasks.exe 2060 schtasks.exe 2468 schtasks.exe 644 schtasks.exe 2928 schtasks.exe 1648 schtasks.exe 1316 schtasks.exe 2644 schtasks.exe 484 schtasks.exe 2860 schtasks.exe 2436 schtasks.exe 1612 schtasks.exe 2564 schtasks.exe 2832 schtasks.exe 2200 schtasks.exe 1928 schtasks.exe 2836 schtasks.exe 304 schtasks.exe 2844 schtasks.exe 2080 schtasks.exe 408 schtasks.exe 1704 schtasks.exe 2576 schtasks.exe 2756 schtasks.exe 2888 schtasks.exe 2216 schtasks.exe 2848 schtasks.exe 2668 schtasks.exe 1720 schtasks.exe 2544 schtasks.exe 2952 schtasks.exe 380 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2468 schtasks.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2764 CMD.exe 356 schtasks.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 1460 CMD.exe 1232 schtasks.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2408 CMD.exe 2216 schtasks.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2784 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 32 PID 2332 wrote to memory of 2784 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 32 PID 2332 wrote to memory of 2784 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 32 PID 2784 wrote to memory of 2564 2784 CMD.exe 34 PID 2784 wrote to memory of 2564 2784 CMD.exe 34 PID 2784 wrote to memory of 2564 2784 CMD.exe 34 PID 2332 wrote to memory of 2580 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 35 PID 2332 wrote to memory of 2580 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 35 PID 2332 wrote to memory of 2580 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 35 PID 2580 wrote to memory of 2832 2580 CMD.exe 37 PID 2580 wrote to memory of 2832 2580 CMD.exe 37 PID 2580 wrote to memory of 2832 2580 CMD.exe 37 PID 2332 wrote to memory of 2608 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 38 PID 2332 wrote to memory of 2608 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 38 PID 2332 wrote to memory of 2608 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 38 PID 2608 wrote to memory of 2468 2608 CMD.exe 40 PID 2608 wrote to memory of 2468 2608 CMD.exe 40 PID 2608 wrote to memory of 2468 2608 CMD.exe 40 PID 2332 wrote to memory of 2764 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 41 PID 2332 wrote to memory of 2764 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 41 PID 2332 wrote to memory of 2764 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 41 PID 2764 wrote to memory of 356 2764 CMD.exe 43 PID 2764 wrote to memory of 356 2764 CMD.exe 43 PID 2764 wrote to memory of 356 2764 CMD.exe 43 PID 2332 wrote to memory of 1460 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 44 PID 2332 wrote to memory of 1460 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 44 PID 2332 wrote to memory of 1460 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 44 PID 1460 wrote to memory of 1232 1460 CMD.exe 46 PID 1460 wrote to memory of 1232 1460 CMD.exe 46 PID 1460 wrote to memory of 1232 1460 CMD.exe 46 PID 2332 wrote to memory of 2408 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 47 PID 2332 wrote to memory of 2408 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 47 PID 2332 wrote to memory of 2408 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 47 PID 2408 wrote to memory of 2216 2408 CMD.exe 49 PID 2408 wrote to memory of 2216 2408 CMD.exe 49 PID 2408 wrote to memory of 2216 2408 CMD.exe 49 PID 2332 wrote to memory of 3028 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 50 PID 2332 wrote to memory of 3028 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 50 PID 2332 wrote to memory of 3028 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 50 PID 3028 wrote to memory of 1316 3028 CMD.exe 52 PID 3028 wrote to memory of 1316 3028 CMD.exe 52 PID 3028 wrote to memory of 1316 3028 CMD.exe 52 PID 2332 wrote to memory of 788 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 53 PID 2332 wrote to memory of 788 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 53 PID 2332 wrote to memory of 788 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 53 PID 788 wrote to memory of 2272 788 CMD.exe 55 PID 788 wrote to memory of 2272 788 CMD.exe 55 PID 788 wrote to memory of 2272 788 CMD.exe 55 PID 2332 wrote to memory of 2448 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 56 PID 2332 wrote to memory of 2448 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 56 PID 2332 wrote to memory of 2448 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 56 PID 2448 wrote to memory of 304 2448 CMD.exe 58 PID 2448 wrote to memory of 304 2448 CMD.exe 58 PID 2448 wrote to memory of 304 2448 CMD.exe 58 PID 2332 wrote to memory of 2928 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 59 PID 2332 wrote to memory of 2928 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 59 PID 2332 wrote to memory of 2928 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 59 PID 2928 wrote to memory of 1644 2928 CMD.exe 61 PID 2928 wrote to memory of 1644 2928 CMD.exe 61 PID 2928 wrote to memory of 1644 2928 CMD.exe 61 PID 2332 wrote to memory of 2412 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 62 PID 2332 wrote to memory of 2412 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 62 PID 2332 wrote to memory of 2412 2332 bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe 62 PID 2412 wrote to memory of 2844 2412 CMD.exe 64 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe"C:\Users\Admin\AppData\Local\Temp\bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\system32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2564
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2832
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "7-Zip" /tr "C:\Windows\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo 5 /tn "7-Zip" /tr "C:\Windows\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2468
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:356
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:1232
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2216
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1316
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2272
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:304
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1644
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2844
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:1652
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2888
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2208
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2544
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:592
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1456
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2212
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2080
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:1620
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2952
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:1940
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:380
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2596
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1444
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:760
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2052
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:1056
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2436
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2564
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2848
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:1596
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2444
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2384
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:320
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:1524
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2644
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2004
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:408
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:696
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2200
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2464
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:484
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2056
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:644
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:896
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2928
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2380
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1648
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2880
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2668
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:3012
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:280
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2756
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2860
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2176
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1612
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:1016
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2024
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2200
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1928
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:948
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1704
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2112
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1720
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2144
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2060
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2824
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2412
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:2880
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2576
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:1792
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2836
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST & exit2⤵PID:400
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\GoogleChrome-CacheCookieFile.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2756
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6