tedy | 3254e933345769887e6036efaf2534ec300f17c7b0c03d51379d28e2d0a635ee

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe
Size 2.6MB
Sample260510-mm4e4sdy2v
SHA256 3254e933345769887e6036efaf2534ec300f17c7b0c03d51379d28e2d0a635ee
MD5 4bd35867ca64b89cf67faed0b923b537
SHA1 e6f9481d49607d4224da0b14627ab840a07bdae9
SHA512 19ac73cd07c5c2499494450ad652894f13b35fd4400152b2d213b798adaad5ac1aca96f3856c501ea57902f3e83a2f60f71205160e90f64a99b23bc880a60466
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4et:ObCjPKNqQEfsw43qtmVfq4i
TLSH
T1AAC5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution tedy persistence trojan

Malware Config

Signatures

Family: Tedy
Tedy is a Windows trojan written in C++.
trojan tedy

Executes dropped EXE 3 IoCs

pid	Process
2484	jhdfkldfhndfkjdfnbfklfnf.exe
3076	winmgr119.exe
4772	winmgr119.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe"	jhdfkldfhndfkjdfnbfklfnf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe"	2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
1	icanhazip.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x002100000002b2dc-3.dat	autoit_exe
behavioral2/files/0x001a00000002b3f8-11.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2484 set thread context of 1056	2484	jhdfkldfhndfkjdfnbfklfnf.exe	81

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA	jhdfkldfhndfkjdfnbfklfnf.exe
File created	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe
File opened for modification	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe:Zone.Identifier:$DATA	2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhdfkldfhndfkjdfnbfklfnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe:Zone.Identifier:$DATA	2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe
File created	C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA	jhdfkldfhndfkjdfnbfklfnf.exe
File created	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe
File opened for modification	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4716	schtasks.exe
224	schtasks.exe
4256	schtasks.exe
3932	schtasks.exe
4568	schtasks.exe
1184	schtasks.exe
4760	schtasks.exe
680	schtasks.exe
4140	schtasks.exe
828	schtasks.exe
3804	schtasks.exe
3980	schtasks.exe
488	schtasks.exe
536	schtasks.exe
4948	schtasks.exe
1176	schtasks.exe
4372	schtasks.exe
3084	schtasks.exe
1620	schtasks.exe
1844	schtasks.exe
1156	schtasks.exe
2564	schtasks.exe
3460	schtasks.exe
4120	schtasks.exe
2460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4868	2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe
4868	2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
3076	winmgr119.exe
3076	winmgr119.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
4772	winmgr119.exe
4772	winmgr119.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe
2484	jhdfkldfhndfkjdfnbfklfnf.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2484	4868	2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe	80
PID 2484 wrote to memory of 1056	2484	jhdfkldfhndfkjdfnbfklfnf.exe	81
PID 2484 wrote to memory of 1056	2484	jhdfkldfhndfkjdfnbfklfnf.exe	81
PID 2484 wrote to memory of 1056	2484	jhdfkldfhndfkjdfnbfklfnf.exe	81
PID 2484 wrote to memory of 4760	2484	jhdfkldfhndfkjdfnbfklfnf.exe	82
PID 2484 wrote to memory of 1844	2484	jhdfkldfhndfkjdfnbfklfnf.exe	86
PID 2484 wrote to memory of 1156	2484	jhdfkldfhndfkjdfnbfklfnf.exe	88
PID 2484 wrote to memory of 488	2484	jhdfkldfhndfkjdfnbfklfnf.exe	90
PID 2484 wrote to memory of 680	2484	jhdfkldfhndfkjdfnbfklfnf.exe	92
PID 2484 wrote to memory of 4716	2484	jhdfkldfhndfkjdfnbfklfnf.exe	94
PID 2484 wrote to memory of 4140	2484	jhdfkldfhndfkjdfnbfklfnf.exe	96
PID 2484 wrote to memory of 828	2484	jhdfkldfhndfkjdfnbfklfnf.exe	98
PID 2484 wrote to memory of 536	2484	jhdfkldfhndfkjdfnbfklfnf.exe	100
PID 2484 wrote to memory of 4948	2484	jhdfkldfhndfkjdfnbfklfnf.exe	103
PID 2484 wrote to memory of 224	2484	jhdfkldfhndfkjdfnbfklfnf.exe	105
PID 2484 wrote to memory of 2564	2484	jhdfkldfhndfkjdfnbfklfnf.exe	107
PID 2484 wrote to memory of 3460	2484	jhdfkldfhndfkjdfnbfklfnf.exe	109
PID 2484 wrote to memory of 4256	2484	jhdfkldfhndfkjdfnbfklfnf.exe	111
PID 2484 wrote to memory of 3804	2484	jhdfkldfhndfkjdfnbfklfnf.exe	113
PID 2484 wrote to memory of 1176	2484	jhdfkldfhndfkjdfnbfklfnf.exe	115
PID 2484 wrote to memory of 3932	2484	jhdfkldfhndfkjdfnbfklfnf.exe	117
PID 2484 wrote to memory of 4120	2484	jhdfkldfhndfkjdfnbfklfnf.exe	119
PID 2484 wrote to memory of 4568	2484	jhdfkldfhndfkjdfnbfklfnf.exe	121
PID 2484 wrote to memory of 3980	2484	jhdfkldfhndfkjdfnbfklfnf.exe	123
PID 2484 wrote to memory of 4372	2484	jhdfkldfhndfkjdfnbfklfnf.exe	125
PID 2484 wrote to memory of 3084	2484	jhdfkldfhndfkjdfnbfklfnf.exe	127
PID 2484 wrote to memory of 2460	2484	jhdfkldfhndfkjdfnbfklfnf.exe	129
PID 2484 wrote to memory of 1620	2484	jhdfkldfhndfkjdfnbfklfnf.exe	131
PID 2484 wrote to memory of 1184	2484	jhdfkldfhndfkjdfnbfklfnf.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-10_4bd35867ca64b89cf67faed0b923b537_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4868
- C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
  C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1056
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1844
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1156
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:488
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:680
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4716
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:828
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:536
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:224
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3460
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4256
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3804
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1176
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3932
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4120
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3980
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4372
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3084
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1620
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1184

C:\ProgramData\winmgr119.exe
C:\ProgramData\winmgr119.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3076

C:\ProgramData\winmgr119.exe
C:\ProgramData\winmgr119.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jhdfkldfhndfkjdfnbfklfnf.exe

Path C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
Size 2.6MB
SHA256 6c7be87b8693790246e0404eef31df3ca0af12ccba49ab006a6dedf7d5bcdee9
MD5 663997fc1eb076b8076cf10bdd68cbf2
SHA1 69defc27c1704f07a8a123895167329684271b93
SHA512 2c524aac2b2240a1a7d98b170841f476e8d9b4fcea4f1e9e0d12699ff7b68d730e892db916d43986f529490a04bc7814013a1b43e37def44e63bfb53ae17b36d
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e2:ObCjPKNqQEfsw43qtmVfq4n
TLSH
T1C6C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winmgr119.exe

Path C:\ProgramData\winmgr119.exe
Size 2.6MB
SHA256 54b1270c8dd3f151d5696f932f2de740b041f55620d5b4ac0b2d662bb21352b5
MD5 f5aa59c420f0b8c47521bf2906976d74
SHA1 8114d17618c5012828a907ca815008af7591d87b
SHA512 534e99b6dd20ecf5982463e8af0a4b70b525237a918413bf1ce4c58b7be36e1ab03fe183a74065aba2fa18f783a9256034f17fa49b45b1930162779c7f769a70
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4eV:ObCjPKNqQEfsw43qtmVfq4y
TLSH
T1FAC5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-8-0x0000000000900000-0x00000000009CA000-memory.dmp

Download

memory/1056-9-0x00000000736D1000-0x00000000736D2000-memory.dmp

Download

memory/1056-10-0x00000000736D0000-0x0000000073C81000-memory.dmp

Download

memory/1056-13-0x00000000736D0000-0x0000000073C81000-memory.dmp

Download