sheetrat | e5071a52d4b3b6a684aa7c274790bcafb526d182d2d4d2b6dae8b7935fcbb941

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sv1nLocker.exe
Size 121KB
Sample260810-pjenpaybpf
SHA256 e5071a52d4b3b6a684aa7c274790bcafb526d182d2d4d2b6dae8b7935fcbb941
MD5 38a8301892ee64e5a97fc046d7cff6c1
SHA1 7fda779ffa53a668e38ecc2f9b92dce22fbc9017
SHA512 96414a3e4760db3fbdb9ed83aa1d14f895785d174046cc45d4629e81fb482935929387a7c469995d27fed20065838d09f7bd06a231ba39e348479296ccba3980
SSDEEP 1536:BELOK0rZBvcYzWrQzBXnvjObU5N92F0wZ:6O2rCB3vjObU5b2lZ
TLSH
T1F8C3D3447784C950D4AE1AB59E13E3C49339FD636D12E30A3D8AB39D2F363D88906EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gay12311 discovery execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

gay12311

91.92.47.228:1360

Mutex

Attributes

anti_virtual
false
certificate
4p7bzzmfqz4zgox9j0boeendqlt
exclusion_wd
true
hidden_file
true
install
true
install_watch_dog
true
key
74eorxr972cwfld1wm4
path_client
%Cookies%\WindowsHeath.exe
path_watch_dog
%Templates%\svchost.exe
pump
false
rootkit
false
task_client
svchost.exe
use_install_admin
true
user_init
true

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/560-0-0x000001F48E1D0000-0x000001F48E1F4000-memory.dmp	family_sheetrat_v1
behavioral1/files/0x000800000002447b-7.dat	family_sheetrat_v1

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\WindowsHeath.exe"	sv1nLocker.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	sv1nLocker.exe

Executes dropped EXE 4 IoCs

pid	Process
2496	WindowsHeath.exe
1868	WindowsHeath.exe
828	WindowsHeath.exe
4432	WindowsHeath.exe

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
59	ipinfo.io
7	api.ipify.org
8	api.ipify.org
12	api.ipify.org
23	icanhazip.com
24	icanhazip.com
43	api.ipify.org
58	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 33 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1032	cmd.exe
2428	cmd.exe
3316	cmd.exe
4956	cmd.exe
1808	cmd.exe
1496	cmd.exe
4632	cmd.exe
1752	cmd.exe
2280	cmd.exe
3648	cmd.exe
2552	cmd.exe
4696	cmd.exe
3592	cmd.exe
1716	cmd.exe
2372	cmd.exe
4976	cmd.exe
716	cmd.exe
1164	cmd.exe
4220	cmd.exe
2588	cmd.exe
3308	cmd.exe
4444	cmd.exe
1140	cmd.exe
4492	cmd.exe
4932	cmd.exe
644	cmd.exe
2656	cmd.exe
4760	cmd.exe
1440	cmd.exe
1776	cmd.exe
2200	cmd.exe
3152	cmd.exe
2160	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	sv1nLocker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3504	schtasks.exe
4876	schtasks.exe
4884	schtasks.exe
2472	schtasks.exe
952	schtasks.exe
4084	schtasks.exe
3260	schtasks.exe
4456	schtasks.exe
1748	schtasks.exe
1876	schtasks.exe
2500	schtasks.exe
4956	schtasks.exe
3040	schtasks.exe
636	schtasks.exe
3148	schtasks.exe
3176	schtasks.exe
1888	schtasks.exe
4188	schtasks.exe
4412	schtasks.exe
988	schtasks.exe
4136	schtasks.exe
2000	schtasks.exe
4628	schtasks.exe
3200	schtasks.exe
1748	schtasks.exe
5048	schtasks.exe
1488	schtasks.exe
2172	schtasks.exe
3228	schtasks.exe
2288	schtasks.exe
2504	schtasks.exe
3196	schtasks.exe
4776	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	sv1nLocker.exe
Token: SeDebugPrivilege	2496	WindowsHeath.exe
Token: SeDebugPrivilege	1868	WindowsHeath.exe
Token: SeIncBasePriorityPrivilege	1868	WindowsHeath.exe
Token: SeDebugPrivilege	828	WindowsHeath.exe
Token: SeDebugPrivilege	4432	WindowsHeath.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2268	560	sv1nLocker.exe	89
PID 560 wrote to memory of 3152	560	sv1nLocker.exe	90
PID 3152 wrote to memory of 3200	3152	cmd.exe	93
PID 560 wrote to memory of 4444	560	sv1nLocker.exe	94
PID 4444 wrote to memory of 1888	4444	cmd.exe	96
PID 560 wrote to memory of 2496	560	sv1nLocker.exe	97
PID 1868 wrote to memory of 2372	1868	WindowsHeath.exe	103
PID 2372 wrote to memory of 4136	2372	cmd.exe	105
PID 2496 wrote to memory of 2552	2496	WindowsHeath.exe	107
PID 2552 wrote to memory of 2500	2552	cmd.exe	109
PID 1868 wrote to memory of 2160	1868	WindowsHeath.exe	110
PID 2160 wrote to memory of 2172	2160	cmd.exe	112
PID 1868 wrote to memory of 2588	1868	WindowsHeath.exe	113
PID 2588 wrote to memory of 1748	2588	cmd.exe	115
PID 1868 wrote to memory of 644	1868	WindowsHeath.exe	118
PID 644 wrote to memory of 4956	644	cmd.exe	120
PID 1868 wrote to memory of 1032	1868	WindowsHeath.exe	123
PID 1032 wrote to memory of 4188	1032	cmd.exe	125
PID 1868 wrote to memory of 1496	1868	WindowsHeath.exe	131
PID 1496 wrote to memory of 3260	1496	cmd.exe	133
PID 1868 wrote to memory of 2656	1868	WindowsHeath.exe	134
PID 2656 wrote to memory of 3504	2656	cmd.exe	136
PID 828 wrote to memory of 4976	828	WindowsHeath.exe	139
PID 4976 wrote to memory of 3228	4976	cmd.exe	141
PID 1868 wrote to memory of 4696	1868	WindowsHeath.exe	142
PID 4696 wrote to memory of 3040	4696	cmd.exe	144
PID 1868 wrote to memory of 4632	1868	WindowsHeath.exe	145
PID 4632 wrote to memory of 5048	4632	cmd.exe	147
PID 1868 wrote to memory of 2428	1868	WindowsHeath.exe	149
PID 2428 wrote to memory of 4456	2428	cmd.exe	151
PID 1868 wrote to memory of 1140	1868	WindowsHeath.exe	152
PID 1140 wrote to memory of 2288	1140	cmd.exe	154
PID 1868 wrote to memory of 3316	1868	WindowsHeath.exe	156
PID 3316 wrote to memory of 1748	3316	cmd.exe	158
PID 1868 wrote to memory of 3308	1868	WindowsHeath.exe	159
PID 3308 wrote to memory of 4876	3308	cmd.exe	161
PID 1868 wrote to memory of 1716	1868	WindowsHeath.exe	162
PID 1716 wrote to memory of 2504	1716	cmd.exe	164
PID 1868 wrote to memory of 716	1868	WindowsHeath.exe	165
PID 716 wrote to memory of 3196	716	cmd.exe	167
PID 1868 wrote to memory of 1752	1868	WindowsHeath.exe	168
PID 1752 wrote to memory of 4412	1752	cmd.exe	170
PID 1868 wrote to memory of 4760	1868	WindowsHeath.exe	171
PID 4760 wrote to memory of 2000	4760	cmd.exe	173
PID 1868 wrote to memory of 2280	1868	WindowsHeath.exe	174
PID 2280 wrote to memory of 636	2280	cmd.exe	176
PID 1868 wrote to memory of 4492	1868	WindowsHeath.exe	178
PID 4492 wrote to memory of 4628	4492	cmd.exe	180
PID 1868 wrote to memory of 1440	1868	WindowsHeath.exe	182
PID 1440 wrote to memory of 1876	1440	cmd.exe	184
PID 1868 wrote to memory of 4932	1868	WindowsHeath.exe	185
PID 4932 wrote to memory of 1488	4932	cmd.exe	187
PID 4432 wrote to memory of 1164	4432	WindowsHeath.exe	188
PID 1164 wrote to memory of 3176	1164	cmd.exe	190
PID 1868 wrote to memory of 4220	1868	WindowsHeath.exe	191
PID 4220 wrote to memory of 4884	4220	cmd.exe	193
PID 1868 wrote to memory of 2200	1868	WindowsHeath.exe	194
PID 2200 wrote to memory of 2472	2200	cmd.exe	196
PID 1868 wrote to memory of 3648	1868	WindowsHeath.exe	197
PID 3648 wrote to memory of 988	3648	cmd.exe	199
PID 1868 wrote to memory of 4956	1868	WindowsHeath.exe	200
PID 4956 wrote to memory of 4776	4956	cmd.exe	202
PID 1868 wrote to memory of 3592	1868	WindowsHeath.exe	203
PID 3592 wrote to memory of 952	3592	cmd.exe	205

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv1nLocker.exe
"C:\Users\Admin\AppData\Local\Temp\sv1nLocker.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="9VUwB_;oBUc|Bn" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" enable=yes & exit
  2⤵
  PID:2268
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3200
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1888
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2500

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1748
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4956
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3260
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2288
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1748
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3196
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4412
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:636
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1488
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4884
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2472
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:988
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4776
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:952
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3148

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3228

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHeath.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsHeath.exe.log
Size 1KB
SHA256 d049789c187b2f58c900eab10205bc037740dca8640ab40c314790fefaab66ff
MD5 f26118d675c61402c218ac6794d90a63
SHA1 ffc8d592f3ca8255ca5119eff5b576eb16ac7fac
SHA512 6f14b71dae095131053a1b590e60ccec4e14c47c745bf9d52de48988d7b93b1f50bbb6bac0222dc49e3e45def052b20be2d34e116991027718da2e0fb8eb45d0
TLSH
T17411CE723371F1D889163F072C68268417BF4724BA90EE0CB5A8626ED9364275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHeath.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WindowsHeath.exe
Size 121KB
SHA256 e5071a52d4b3b6a684aa7c274790bcafb526d182d2d4d2b6dae8b7935fcbb941
MD5 38a8301892ee64e5a97fc046d7cff6c1
SHA1 7fda779ffa53a668e38ecc2f9b92dce22fbc9017
SHA512 96414a3e4760db3fbdb9ed83aa1d14f895785d174046cc45d4629e81fb482935929387a7c469995d27fed20065838d09f7bd06a231ba39e348479296ccba3980
SSDEEP 1536:BELOK0rZBvcYzWrQzBXnvjObU5N92F0wZ:6O2rCB3vjObU5b2lZ
TLSH
T1F8C3D3447784C950D4AE1AB59E13E3C49339FD636D12E30A3D8AB39D2F363D88906EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads