tedy | 302fced0739b7415e0a9617d8563bd7c6f1f80b7d651dff4865fd46837d0bd28

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe
Size 2.6MB
Sample260523-rw2ebsdv6x
SHA256 302fced0739b7415e0a9617d8563bd7c6f1f80b7d651dff4865fd46837d0bd28
MD5 0ebaf21b7d51ef1d33808a8a24291c4d
SHA1 d073ac9444e8349ef80e6c545bdd74dbf5f4168f
SHA512 efaa539abdf5dabbbc9447d13c49d39b02b9ed70f28f274cf30a1238420d16b382e8031948554186b5b606e004e12a22276f4858195982ec73cc9aa1db693a41
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e5:ObCjPKNqQEfsw43qtmVfq4g
TLSH
T152C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution tedy persistence trojan

Malware Config

Signatures

Family: Tedy
Tedy is a Windows trojan written in C++.
trojan tedy

Executes dropped EXE 3 IoCs

pid	Process
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4560	winmgr119.exe
4332	winmgr119.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe"	jhdfkldfhndfkjdfnbfklfnf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe"	2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com
1	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x001a00000002b48a-3.dat	autoit_exe
behavioral2/files/0x001a00000002b48b-12.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4892 set thread context of 912	4892	jhdfkldfhndfkjdfnbfklfnf.exe	81

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA	jhdfkldfhndfkjdfnbfklfnf.exe
File created	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe
File opened for modification	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe:Zone.Identifier:$DATA	2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhdfkldfhndfkjdfnbfklfnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe:Zone.Identifier:$DATA	2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe
File created	C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA	jhdfkldfhndfkjdfnbfklfnf.exe
File created	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe
File opened for modification	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 26 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1964	schtasks.exe
1052	schtasks.exe
1936	schtasks.exe
2808	schtasks.exe
1120	schtasks.exe
4688	schtasks.exe
3788	schtasks.exe
3760	schtasks.exe
4732	schtasks.exe
1220	schtasks.exe
1156	schtasks.exe
2972	schtasks.exe
4132	schtasks.exe
1084	schtasks.exe
1880	schtasks.exe
4244	schtasks.exe
4132	schtasks.exe
5104	schtasks.exe
3492	schtasks.exe
240	schtasks.exe
4160	schtasks.exe
4660	schtasks.exe
4424	schtasks.exe
2460	schtasks.exe
1592	schtasks.exe
1536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2072	2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe
2072	2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4560	winmgr119.exe
4560	winmgr119.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4332	winmgr119.exe
4332	winmgr119.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe
4892	jhdfkldfhndfkjdfnbfklfnf.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4892	2072	2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe	80
PID 4892 wrote to memory of 912	4892	jhdfkldfhndfkjdfnbfklfnf.exe	81
PID 4892 wrote to memory of 912	4892	jhdfkldfhndfkjdfnbfklfnf.exe	81
PID 4892 wrote to memory of 912	4892	jhdfkldfhndfkjdfnbfklfnf.exe	81
PID 4892 wrote to memory of 1536	4892	jhdfkldfhndfkjdfnbfklfnf.exe	82
PID 4892 wrote to memory of 5104	4892	jhdfkldfhndfkjdfnbfklfnf.exe	86
PID 4892 wrote to memory of 4132	4892	jhdfkldfhndfkjdfnbfklfnf.exe	88
PID 4892 wrote to memory of 3760	4892	jhdfkldfhndfkjdfnbfklfnf.exe	90
PID 4892 wrote to memory of 3492	4892	jhdfkldfhndfkjdfnbfklfnf.exe	93
PID 4892 wrote to memory of 4732	4892	jhdfkldfhndfkjdfnbfklfnf.exe	95
PID 4892 wrote to memory of 240	4892	jhdfkldfhndfkjdfnbfklfnf.exe	97
PID 4892 wrote to memory of 1964	4892	jhdfkldfhndfkjdfnbfklfnf.exe	99
PID 4892 wrote to memory of 1052	4892	jhdfkldfhndfkjdfnbfklfnf.exe	101
PID 4892 wrote to memory of 4160	4892	jhdfkldfhndfkjdfnbfklfnf.exe	103
PID 4892 wrote to memory of 1936	4892	jhdfkldfhndfkjdfnbfklfnf.exe	105
PID 4892 wrote to memory of 1084	4892	jhdfkldfhndfkjdfnbfklfnf.exe	107
PID 4892 wrote to memory of 4660	4892	jhdfkldfhndfkjdfnbfklfnf.exe	109
PID 4892 wrote to memory of 4424	4892	jhdfkldfhndfkjdfnbfklfnf.exe	111
PID 4892 wrote to memory of 2460	4892	jhdfkldfhndfkjdfnbfklfnf.exe	113
PID 4892 wrote to memory of 1592	4892	jhdfkldfhndfkjdfnbfklfnf.exe	115
PID 4892 wrote to memory of 2808	4892	jhdfkldfhndfkjdfnbfklfnf.exe	117
PID 4892 wrote to memory of 1120	4892	jhdfkldfhndfkjdfnbfklfnf.exe	119
PID 4892 wrote to memory of 1220	4892	jhdfkldfhndfkjdfnbfklfnf.exe	121
PID 4892 wrote to memory of 4688	4892	jhdfkldfhndfkjdfnbfklfnf.exe	123
PID 4892 wrote to memory of 1880	4892	jhdfkldfhndfkjdfnbfklfnf.exe	125
PID 4892 wrote to memory of 3788	4892	jhdfkldfhndfkjdfnbfklfnf.exe	127
PID 4892 wrote to memory of 1156	4892	jhdfkldfhndfkjdfnbfklfnf.exe	129
PID 4892 wrote to memory of 2972	4892	jhdfkldfhndfkjdfnbfklfnf.exe	131
PID 4892 wrote to memory of 4244	4892	jhdfkldfhndfkjdfnbfklfnf.exe	133
PID 4892 wrote to memory of 4132	4892	jhdfkldfhndfkjdfnbfklfnf.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_0ebaf21b7d51ef1d33808a8a24291c4d_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072
- C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
  C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:912
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1536
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5104
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3760
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3492
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4732
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:240
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1964
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1052
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1084
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4660
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4424
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1592
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1120
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1220
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1880
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3788
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1156
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2972
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4244
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4132

C:\ProgramData\winmgr119.exe
C:\ProgramData\winmgr119.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4560

C:\ProgramData\winmgr119.exe
C:\ProgramData\winmgr119.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jhdfkldfhndfkjdfnbfklfnf.exe

Path C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
Size 2.6MB
SHA256 93b9212798b48f6d3ee060cdf2dfe13b23f5f96bd329651ea195df8fdb209e9b
MD5 e1062681ca18f0de7033300680fa9a61
SHA1 919fc57137fab2754b4fcd69f0475fcc6f5de99f
SHA512 0dd81122f1fbe3a0445cba5fbeea6031f370851e8c9bbd4dbc9f861b33b5698a1c1b53a63f804ebb6d8ca8b90f3938bfcdeaae140d1d516e107e05498473ab13
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e7:ObCjPKNqQEfsw43qtmVfq4g
TLSH
T154C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winmgr119.exe

Path C:\ProgramData\winmgr119.exe
Size 2.6MB
SHA256 d11f332b308a0c1909f63c0cd3a2c5882b8685696b80d13e42f493f994a86324
MD5 353e294a75b4a7bba139c78ea21a20a9
SHA1 cdfeea762781f5c72adaf11aab243adff62f8af7
SHA512 2302215cbca50bd51d07d769d5bac1f89c06c028582faacdd16eeab3c19d9107b0aeb6a4034e0f9783634c32391a8795f61dd55e3def588eb61ce2f5a7565aaa
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e6:ObCjPKNqQEfsw43qtmVfq47
TLSH
T17EC5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-8-0x0000000001300000-0x00000000013CA000-memory.dmp

Download

memory/912-9-0x0000000073161000-0x0000000073162000-memory.dmp

Download

memory/912-10-0x0000000073160000-0x0000000073711000-memory.dmp

Download

memory/912-14-0x0000000073160000-0x0000000073711000-memory.dmp

Download