wtf community v1.0.0

HostedAgent.exe

Whoami? HostedAgent, of course!

📋 Live Preview 
HostedAgent.exe
HostedAgent.exe

Sandbox: execFile · Timeout: 30s

Capabilities

credential.discovery.whoami

Documentation

examples:

  • description: "Execute HostedAgent.exe and observe the unusual behavior" command: "HostedAgent.exe"

HostedAgent.exe

Whoami? HostedAgent, of course!

Trend Micro WFBS Agent runs whoami.exe regularly as SYSTEM for reasons unknown.

Contributed by Biffalo

References