084a3386e4ed78fa71b3bc04ab39060e17649d322b66291000811b848c1732fb

Analysis

max time kernel
148s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
30/03/2025, 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

neratochka.exe
Size

790KB
MD5

926f11c3cd1b5536cfa92670df6221a5
SHA1

906b8b341d8ee28f391f1af2ba96afc2bc9fd4a7
SHA256

084a3386e4ed78fa71b3bc04ab39060e17649d322b66291000811b848c1732fb
SHA512

4d81c2542c583289a1bcf160d15df6fa1f631945b6324964a3cd47ab3088cdfb3f8a65b9d385a86fb954c9d54cff442c4049be5158dc66a9624ad0110b3f1722
SSDEEP

12288:7+LfLwZHZl6Rbxmk5CIqYn5+iNTXSfiyIh+r7s6AjZ+silrV:6LMNZio5I5FSPg++4

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Documents\\aops.exe"	neratochka.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\aop.exe	neratochka.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5752	schtasks.exe
4220	schtasks.exe
2692	schtasks.exe
5556	schtasks.exe
5220	schtasks.exe
4736	schtasks.exe
4160	schtasks.exe
2688	schtasks.exe
1564	schtasks.exe
872	schtasks.exe
4916	schtasks.exe
4644	schtasks.exe
5280	schtasks.exe
4896	schtasks.exe
4868	schtasks.exe
4876	schtasks.exe
2320	schtasks.exe
2080	schtasks.exe
324	schtasks.exe
1140	schtasks.exe
4464	schtasks.exe
2700	schtasks.exe
5544	schtasks.exe
5712	schtasks.exe
3972	schtasks.exe
4424	schtasks.exe
4672	schtasks.exe
3208	schtasks.exe
1964	schtasks.exe
1752	schtasks.exe
4880	schtasks.exe
2328	schtasks.exe
5576	schtasks.exe
5088	schtasks.exe
6124	schtasks.exe
4924	schtasks.exe
5604	schtasks.exe
4624	schtasks.exe
1952	schtasks.exe
2156	schtasks.exe
3852	schtasks.exe
5180	schtasks.exe
5992	schtasks.exe
3332	schtasks.exe
2724	schtasks.exe
1768	schtasks.exe
3772	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	neratochka.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3680	4544	neratochka.exe	89
PID 4544 wrote to memory of 3680	4544	neratochka.exe	89
PID 4544 wrote to memory of 2600	4544	neratochka.exe	91
PID 4544 wrote to memory of 2600	4544	neratochka.exe	91
PID 4544 wrote to memory of 4280	4544	neratochka.exe	92
PID 4544 wrote to memory of 4280	4544	neratochka.exe	92
PID 4280 wrote to memory of 4868	4280	CMD.exe	95
PID 3680 wrote to memory of 4876	3680	CMD.exe	96
PID 3680 wrote to memory of 4876	3680	CMD.exe	96
PID 4280 wrote to memory of 4868	4280	CMD.exe	95
PID 2600 wrote to memory of 4880	2600	CMD.exe	97
PID 2600 wrote to memory of 4880	2600	CMD.exe	97
PID 4544 wrote to memory of 5096	4544	neratochka.exe	98
PID 4544 wrote to memory of 5096	4544	neratochka.exe	98
PID 5096 wrote to memory of 4736	5096	CMD.exe	100
PID 5096 wrote to memory of 4736	5096	CMD.exe	100
PID 4544 wrote to memory of 5684	4544	neratochka.exe	101
PID 4544 wrote to memory of 5684	4544	neratochka.exe	101
PID 5684 wrote to memory of 5752	5684	CMD.exe	103
PID 5684 wrote to memory of 5752	5684	CMD.exe	103
PID 4544 wrote to memory of 1012	4544	neratochka.exe	104
PID 4544 wrote to memory of 1012	4544	neratochka.exe	104
PID 1012 wrote to memory of 2320	1012	CMD.exe	106
PID 1012 wrote to memory of 2320	1012	CMD.exe	106
PID 4544 wrote to memory of 2200	4544	neratochka.exe	107
PID 4544 wrote to memory of 2200	4544	neratochka.exe	107
PID 2200 wrote to memory of 2328	2200	CMD.exe	109
PID 2200 wrote to memory of 2328	2200	CMD.exe	109
PID 4544 wrote to memory of 6120	4544	neratochka.exe	111
PID 4544 wrote to memory of 6120	4544	neratochka.exe	111
PID 6120 wrote to memory of 4160	6120	CMD.exe	113
PID 6120 wrote to memory of 4160	6120	CMD.exe	113
PID 4544 wrote to memory of 4328	4544	neratochka.exe	114
PID 4544 wrote to memory of 4328	4544	neratochka.exe	114
PID 4328 wrote to memory of 5992	4328	CMD.exe	116
PID 4328 wrote to memory of 5992	4328	CMD.exe	116
PID 4544 wrote to memory of 688	4544	neratochka.exe	117
PID 4544 wrote to memory of 688	4544	neratochka.exe	117
PID 688 wrote to memory of 5544	688	CMD.exe	119
PID 688 wrote to memory of 5544	688	CMD.exe	119
PID 4544 wrote to memory of 1784	4544	neratochka.exe	120
PID 4544 wrote to memory of 1784	4544	neratochka.exe	120
PID 1784 wrote to memory of 4220	1784	CMD.exe	122
PID 1784 wrote to memory of 4220	1784	CMD.exe	122
PID 4544 wrote to memory of 4432	4544	neratochka.exe	123
PID 4544 wrote to memory of 4432	4544	neratochka.exe	123
PID 4432 wrote to memory of 5712	4432	CMD.exe	125
PID 4432 wrote to memory of 5712	4432	CMD.exe	125
PID 4544 wrote to memory of 5060	4544	neratochka.exe	126
PID 4544 wrote to memory of 5060	4544	neratochka.exe	126
PID 5060 wrote to memory of 4624	5060	CMD.exe	128
PID 5060 wrote to memory of 4624	5060	CMD.exe	128
PID 4544 wrote to memory of 3092	4544	neratochka.exe	129
PID 4544 wrote to memory of 3092	4544	neratochka.exe	129
PID 3092 wrote to memory of 3972	3092	CMD.exe	131
PID 3092 wrote to memory of 3972	3092	CMD.exe	131
PID 4544 wrote to memory of 3620	4544	neratochka.exe	132
PID 4544 wrote to memory of 3620	4544	neratochka.exe	132
PID 3620 wrote to memory of 3332	3620	CMD.exe	134
PID 3620 wrote to memory of 3332	3620	CMD.exe	134
PID 4544 wrote to memory of 2140	4544	neratochka.exe	135
PID 4544 wrote to memory of 2140	4544	neratochka.exe	135
PID 2140 wrote to memory of 5576	2140	CMD.exe	137
PID 2140 wrote to memory of 5576	2140	CMD.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\neratochka.exe
"C:\Users\Admin\AppData\Local\Temp\neratochka.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\Documents\aops.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "IntelliJ IDEA Host" /tr "C:\Users\Admin\Documents\aops.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "PnkbstrA" /tr "C:\Program Files\aop.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "PnkbstrA" /tr "C:\Program Files\aop.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4736
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:1624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:1740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:4656
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:3488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:4460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:6104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:3276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:2592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:2540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:1232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:1028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:3512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:2580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:3096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:5636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:4828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:4848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:4936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:1508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:5068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:4236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:1644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:1368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:4428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:4984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:5272
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:2892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST & exit
  2⤵
  PID:2752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Outposts" /tr "C:\Users\Admin\Documents\aops.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\aops.exe

Filesize
790KB

MD5
926f11c3cd1b5536cfa92670df6221a5

SHA1
906b8b341d8ee28f391f1af2ba96afc2bc9fd4a7

SHA256
084a3386e4ed78fa71b3bc04ab39060e17649d322b66291000811b848c1732fb

SHA512
4d81c2542c583289a1bcf160d15df6fa1f631945b6324964a3cd47ab3088cdfb3f8a65b9d385a86fb954c9d54cff442c4049be5158dc66a9624ad0110b3f1722

Download Submit
memory/4544-0-0x00007FFE28BE3000-0x00007FFE28BE5000-memory.dmp

Filesize
8KB

Download
memory/4544-1-0x00000000001A0000-0x000000000026C000-memory.dmp

Filesize
816KB

Download
memory/4544-2-0x00007FFE28BE3000-0x00007FFE28BE5000-memory.dmp

Filesize
8KB

Download
memory/4544-5-0x00007FFE28BE0000-0x00007FFE296A2000-memory.dmp

Filesize
10.8MB

Download
memory/4544-12-0x00007FFE28BE0000-0x00007FFE296A2000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads