33af3e0f5884bfae36bf081b9eb0ca696c9d3620e74255f72ef1291983e49213

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

runonce.cmd
Size

11KB
MD5

6e419580c83dc37ea0d4180edf970d8d
SHA1

925a3a9bb26c499419a9af243bc2c7cc8269057d
SHA256

b9106c1bfd52fc13d097951b44d3f6f2023f5e31e9bbbf8dbccf8aad3b6adcd7
SHA512

9021fff118365e8d384ef7ac41779ea6eca60ff30da2d8d1e36a8382594847cb6bfdd0d614cee3c2cba6c20b998020dd2289ec642b6380691b0e8548046cd3a7
SSDEEP

192:/g5FLWfHOgMRFRY2GzTjiUY1pNcaSnnvmIUJYI53TWOC799AGDvUOF5QxyJtQmFK:/g5FLWfHOgMRFRY2GzTjiUY1pNcaSnnm

Score

8^/10

persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2112	sc.exe
2124	sc.exe

Runs net.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2112	2224	cmd.exe	29
PID 2224 wrote to memory of 2112	2224	cmd.exe	29
PID 2224 wrote to memory of 2112	2224	cmd.exe	29
PID 2224 wrote to memory of 2124	2224	cmd.exe	31
PID 2224 wrote to memory of 2124	2224	cmd.exe	31
PID 2224 wrote to memory of 2124	2224	cmd.exe	31
PID 2224 wrote to memory of 2164	2224	cmd.exe	30
PID 2224 wrote to memory of 2164	2224	cmd.exe	30
PID 2224 wrote to memory of 2164	2224	cmd.exe	30
PID 2164 wrote to memory of 2156	2164	net.exe	32
PID 2164 wrote to memory of 2156	2164	net.exe	32
PID 2164 wrote to memory of 2156	2164	net.exe	32
PID 2224 wrote to memory of 2188	2224	cmd.exe	33
PID 2224 wrote to memory of 2188	2224	cmd.exe	33
PID 2224 wrote to memory of 2188	2224	cmd.exe	33
PID 2224 wrote to memory of 2564	2224	cmd.exe	34
PID 2224 wrote to memory of 2564	2224	cmd.exe	34
PID 2224 wrote to memory of 2564	2224	cmd.exe	34
PID 2224 wrote to memory of 3000	2224	cmd.exe	35
PID 2224 wrote to memory of 3000	2224	cmd.exe	35
PID 2224 wrote to memory of 3000	2224	cmd.exe	35
PID 2224 wrote to memory of 2572	2224	cmd.exe	36
PID 2224 wrote to memory of 2572	2224	cmd.exe	36
PID 2224 wrote to memory of 2572	2224	cmd.exe	36
PID 2224 wrote to memory of 2624	2224	cmd.exe	37
PID 2224 wrote to memory of 2624	2224	cmd.exe	37
PID 2224 wrote to memory of 2624	2224	cmd.exe	37
PID 2224 wrote to memory of 2700	2224	cmd.exe	38
PID 2224 wrote to memory of 2700	2224	cmd.exe	38
PID 2224 wrote to memory of 2700	2224	cmd.exe	38
PID 2224 wrote to memory of 2740	2224	cmd.exe	39
PID 2224 wrote to memory of 2740	2224	cmd.exe	39
PID 2224 wrote to memory of 2740	2224	cmd.exe	39
PID 2224 wrote to memory of 2636	2224	cmd.exe	40
PID 2224 wrote to memory of 2636	2224	cmd.exe	40
PID 2224 wrote to memory of 2636	2224	cmd.exe	40
PID 2224 wrote to memory of 2748	2224	cmd.exe	41
PID 2224 wrote to memory of 2748	2224	cmd.exe	41
PID 2224 wrote to memory of 2748	2224	cmd.exe	41
PID 2224 wrote to memory of 2672	2224	cmd.exe	42
PID 2224 wrote to memory of 2672	2224	cmd.exe	42
PID 2224 wrote to memory of 2672	2224	cmd.exe	42
PID 2224 wrote to memory of 2640	2224	cmd.exe	43
PID 2224 wrote to memory of 2640	2224	cmd.exe	43
PID 2224 wrote to memory of 2640	2224	cmd.exe	43
PID 2224 wrote to memory of 2660	2224	cmd.exe	44
PID 2224 wrote to memory of 2660	2224	cmd.exe	44
PID 2224 wrote to memory of 2660	2224	cmd.exe	44
PID 2224 wrote to memory of 2504	2224	cmd.exe	45
PID 2224 wrote to memory of 2504	2224	cmd.exe	45
PID 2224 wrote to memory of 2504	2224	cmd.exe	45
PID 2224 wrote to memory of 2616	2224	cmd.exe	46
PID 2224 wrote to memory of 2616	2224	cmd.exe	46
PID 2224 wrote to memory of 2616	2224	cmd.exe	46
PID 2224 wrote to memory of 956	2224	cmd.exe	47
PID 2224 wrote to memory of 956	2224	cmd.exe	47
PID 2224 wrote to memory of 956	2224	cmd.exe	47
PID 2224 wrote to memory of 2492	2224	cmd.exe	48
PID 2224 wrote to memory of 2492	2224	cmd.exe	48
PID 2224 wrote to memory of 2492	2224	cmd.exe	48
PID 2224 wrote to memory of 2544	2224	cmd.exe	49
PID 2224 wrote to memory of 2544	2224	cmd.exe	49
PID 2224 wrote to memory of 2544	2224	cmd.exe	49
PID 2224 wrote to memory of 2844	2224	cmd.exe	50

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\runonce.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\sc.exe
  sc create Schedule binpath= "C:\Windows\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
  2⤵
  - Launches sc.exe
  PID:2112
- C:\Windows\system32\net.exe
  net start "Task Scheduler"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start "Task Scheduler"
    3⤵
    PID:2156
- C:\Windows\system32\sc.exe
  sc config Schedule start= auto
  2⤵
  - Launches sc.exe
  PID:2124
- C:\Windows\system32\at.exe
  at 8:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2188
- C:\Windows\system32\at.exe
  at 8:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2564
- C:\Windows\system32\at.exe
  at 8:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:3000
- C:\Windows\system32\at.exe
  at 9:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2572
- C:\Windows\system32\at.exe
  at 9:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2624
- C:\Windows\system32\at.exe
  at 9:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2700
- C:\Windows\system32\at.exe
  at 10:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2740
- C:\Windows\system32\at.exe
  at 10:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2636
- C:\Windows\system32\at.exe
  at 10:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2748
- C:\Windows\system32\at.exe
  at 11:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2672
- C:\Windows\system32\at.exe
  at 11:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2640
- C:\Windows\system32\at.exe
  at 11:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2660
- C:\Windows\system32\at.exe
  at 12:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2504
- C:\Windows\system32\at.exe
  at 12:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2616
- C:\Windows\system32\at.exe
  at 12:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:956
- C:\Windows\system32\at.exe
  at 13:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2492
- C:\Windows\system32\at.exe
  at 13:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2544
- C:\Windows\system32\at.exe
  at 13:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2844
- C:\Windows\system32\at.exe
  at 14:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2956
- C:\Windows\system32\at.exe
  at 14:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2080
- C:\Windows\system32\at.exe
  at 14:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2180
- C:\Windows\system32\at.exe
  at 15:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:1640
- C:\Windows\system32\at.exe
  at 15:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1588
- C:\Windows\system32\at.exe
  at 15:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1048
- C:\Windows\system32\at.exe
  at 16:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2720
- C:\Windows\system32\at.exe
  at 16:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2792
- C:\Windows\system32\at.exe
  at 16:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2796
- C:\Windows\system32\at.exe
  at 17:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:1792
- C:\Windows\system32\at.exe
  at 17:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1572
- C:\Windows\system32\at.exe
  at 17:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1540
- C:\Windows\system32\at.exe
  at 18:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:1460
- C:\Windows\system32\at.exe
  at 18:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2984
- C:\Windows\system32\at.exe
  at 18:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2932
- C:\Windows\system32\at.exe
  at 19:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2084
- C:\Windows\system32\at.exe
  at 19:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1844
- C:\Windows\system32\at.exe
  at 19:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2464
- C:\Windows\system32\at.exe
  at 20:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2580
- C:\Windows\system32\at.exe
  at 20:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2260
- C:\Windows\system32\at.exe
  at 20:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:324
- C:\Windows\system32\at.exe
  at 21:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:604
- C:\Windows\system32\at.exe
  at 21:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:488
- C:\Windows\system32\at.exe
  at 21:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1012
- C:\Windows\system32\at.exe
  at 22:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:608
- C:\Windows\system32\at.exe
  at 22:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1656
- C:\Windows\system32\at.exe
  at 22:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2136
- C:\Windows\system32\at.exe
  at 23:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:920
- C:\Windows\system32\at.exe
  at 23:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1104
- C:\Windows\system32\at.exe
  at 23:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1636
- C:\Windows\system32\at.exe
  at 00:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1120
- C:\Windows\system32\at.exe
  at 00:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1040
- C:\Windows\system32\at.exe
  at 00:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2204
- C:\Windows\system32\at.exe
  at 10:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1996
- C:\Windows\system32\at.exe
  at 10:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
  2⤵
  PID:3064
- C:\Windows\system32\at.exe
  at 10:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
  2⤵
  PID:1560
- C:\Windows\system32\at.exe
  at 10:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1620
- C:\Windows\system32\at.exe
  at 14:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:788
- C:\Windows\system32\at.exe
  at 14:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
  2⤵
  PID:1916
- C:\Windows\system32\at.exe
  at 14:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
  2⤵
  PID:2040
- C:\Windows\system32\at.exe
  at 14:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1660
- C:\Windows\system32\at.exe
  at 19:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1064
- C:\Windows\system32\at.exe
  at 19:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
  2⤵
  PID:1452
- C:\Windows\system32\at.exe
  at 19:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
  2⤵
  PID:1712
- C:\Windows\system32\at.exe
  at 19:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1764
- C:\Windows\system32\at.exe
  at 21:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:2440
- C:\Windows\system32\at.exe
  at 21:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
  2⤵
  PID:2400
- C:\Windows\system32\at.exe
  at 21:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
  2⤵
  PID:628
- C:\Windows\system32\at.exe
  at 21:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...