Hexacorn | Blog Beyond good ol’ Run key, Part 18
Tags
| attack-pattern: | Server - T1583.004 Server - T1584.004 Logon Scripts - T1037 |
Common Information
| Type | Value |
|---|---|
| UUID | d54fb8a9-f592-4579-a362-b92096440ac0 |
| Fingerprint | 3c53c810f5be04ce |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | Nov. 14, 2014, midnight |
| Added to db | Sept. 26, 2022, 9:31 a.m. |
| Last updated | Nov. 17, 2024, 6:49 p.m. |
| Headline | UNKNOWN |
| Title | Hexacorn | Blog Beyond good ol’ Run key, Part 18 |
| Detected Hints/Tags/Attributes | 20/1/7 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/ |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | File | 50 | userinit.exe |
|
| Details | File | 1260 | explorer.exe |
|
| Details | File | 212 | winlogon.exe |
|
| Details | File | 1 | c:\test\userinitmprlogonscriptlog.bat |
|
| Details | File | 1 | c:\test\userinitmprlogonscript.log |
|
| Details | File | 1 | c:\\test\\userinitmprlogonscript.bat |
|
| Details | Windows Registry Key | 14 | HKEY_CURRENT_USER\Environment |