33af3e0f5884bfae36bf081b9eb0ca696c9d3620e74255f72ef1291983e49213

Analysis

max time kernel
146s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

runonce.cmd
Size

11KB
MD5

6e419580c83dc37ea0d4180edf970d8d
SHA1

925a3a9bb26c499419a9af243bc2c7cc8269057d
SHA256

b9106c1bfd52fc13d097951b44d3f6f2023f5e31e9bbbf8dbccf8aad3b6adcd7
SHA512

9021fff118365e8d384ef7ac41779ea6eca60ff30da2d8d1e36a8382594847cb6bfdd0d614cee3c2cba6c20b998020dd2289ec642b6380691b0e8548046cd3a7
SSDEEP

192:/g5FLWfHOgMRFRY2GzTjiUY1pNcaSnnvmIUJYI53TWOC799AGDvUOF5QxyJtQmFK:/g5FLWfHOgMRFRY2GzTjiUY1pNcaSnnm

Score

8^/10

persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2412	sc.exe
2328	sc.exe

Runs net.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 2412	3220	cmd.exe	88
PID 3220 wrote to memory of 2412	3220	cmd.exe	88
PID 3220 wrote to memory of 2328	3220	cmd.exe	89
PID 3220 wrote to memory of 2328	3220	cmd.exe	89
PID 3220 wrote to memory of 1940	3220	cmd.exe	90
PID 3220 wrote to memory of 1940	3220	cmd.exe	90
PID 1940 wrote to memory of 840	1940	net.exe	91
PID 1940 wrote to memory of 840	1940	net.exe	91
PID 3220 wrote to memory of 912	3220	cmd.exe	92
PID 3220 wrote to memory of 912	3220	cmd.exe	92
PID 3220 wrote to memory of 3704	3220	cmd.exe	93
PID 3220 wrote to memory of 3704	3220	cmd.exe	93
PID 3220 wrote to memory of 680	3220	cmd.exe	94
PID 3220 wrote to memory of 680	3220	cmd.exe	94
PID 3220 wrote to memory of 4016	3220	cmd.exe	95
PID 3220 wrote to memory of 4016	3220	cmd.exe	95
PID 3220 wrote to memory of 2952	3220	cmd.exe	96
PID 3220 wrote to memory of 2952	3220	cmd.exe	96
PID 3220 wrote to memory of 1228	3220	cmd.exe	97
PID 3220 wrote to memory of 1228	3220	cmd.exe	97
PID 3220 wrote to memory of 228	3220	cmd.exe	98
PID 3220 wrote to memory of 228	3220	cmd.exe	98
PID 3220 wrote to memory of 3972	3220	cmd.exe	99
PID 3220 wrote to memory of 3972	3220	cmd.exe	99
PID 3220 wrote to memory of 232	3220	cmd.exe	100
PID 3220 wrote to memory of 232	3220	cmd.exe	100
PID 3220 wrote to memory of 3540	3220	cmd.exe	101
PID 3220 wrote to memory of 3540	3220	cmd.exe	101
PID 3220 wrote to memory of 2020	3220	cmd.exe	102
PID 3220 wrote to memory of 2020	3220	cmd.exe	102
PID 3220 wrote to memory of 2848	3220	cmd.exe	103
PID 3220 wrote to memory of 2848	3220	cmd.exe	103
PID 3220 wrote to memory of 3940	3220	cmd.exe	104
PID 3220 wrote to memory of 3940	3220	cmd.exe	104
PID 3220 wrote to memory of 4600	3220	cmd.exe	105
PID 3220 wrote to memory of 4600	3220	cmd.exe	105
PID 3220 wrote to memory of 2228	3220	cmd.exe	106
PID 3220 wrote to memory of 2228	3220	cmd.exe	106
PID 3220 wrote to memory of 4596	3220	cmd.exe	107
PID 3220 wrote to memory of 4596	3220	cmd.exe	107
PID 3220 wrote to memory of 2984	3220	cmd.exe	109
PID 3220 wrote to memory of 2984	3220	cmd.exe	109
PID 3220 wrote to memory of 2656	3220	cmd.exe	110
PID 3220 wrote to memory of 2656	3220	cmd.exe	110
PID 3220 wrote to memory of 4636	3220	cmd.exe	111
PID 3220 wrote to memory of 4636	3220	cmd.exe	111
PID 3220 wrote to memory of 3452	3220	cmd.exe	112
PID 3220 wrote to memory of 3452	3220	cmd.exe	112
PID 3220 wrote to memory of 2044	3220	cmd.exe	114
PID 3220 wrote to memory of 2044	3220	cmd.exe	114
PID 3220 wrote to memory of 3668	3220	cmd.exe	115
PID 3220 wrote to memory of 3668	3220	cmd.exe	115
PID 3220 wrote to memory of 3484	3220	cmd.exe	116
PID 3220 wrote to memory of 3484	3220	cmd.exe	116
PID 3220 wrote to memory of 2744	3220	cmd.exe	117
PID 3220 wrote to memory of 2744	3220	cmd.exe	117
PID 3220 wrote to memory of 3316	3220	cmd.exe	118
PID 3220 wrote to memory of 3316	3220	cmd.exe	118
PID 3220 wrote to memory of 5016	3220	cmd.exe	119
PID 3220 wrote to memory of 5016	3220	cmd.exe	119
PID 3220 wrote to memory of 1364	3220	cmd.exe	121
PID 3220 wrote to memory of 1364	3220	cmd.exe	121
PID 3220 wrote to memory of 1496	3220	cmd.exe	122
PID 3220 wrote to memory of 1496	3220	cmd.exe	122

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\runonce.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\system32\sc.exe
  sc create Schedule binpath= "C:\Windows\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
  2⤵
  - Launches sc.exe
  PID:2412
- C:\Windows\system32\sc.exe
  sc config Schedule start= auto
  2⤵
  - Launches sc.exe
  PID:2328
- C:\Windows\system32\net.exe
  net start "Task Scheduler"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start "Task Scheduler"
    3⤵
    PID:840
- C:\Windows\system32\at.exe
  at 8:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:912
- C:\Windows\system32\at.exe
  at 8:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:3704
- C:\Windows\system32\at.exe
  at 8:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:680
- C:\Windows\system32\at.exe
  at 9:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:4016
- C:\Windows\system32\at.exe
  at 9:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2952
- C:\Windows\system32\at.exe
  at 9:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1228
- C:\Windows\system32\at.exe
  at 10:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:228
- C:\Windows\system32\at.exe
  at 10:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:3972
- C:\Windows\system32\at.exe
  at 10:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:232
- C:\Windows\system32\at.exe
  at 11:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:3540
- C:\Windows\system32\at.exe
  at 11:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2020
- C:\Windows\system32\at.exe
  at 11:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2848
- C:\Windows\system32\at.exe
  at 12:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:3940
- C:\Windows\system32\at.exe
  at 12:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:4600
- C:\Windows\system32\at.exe
  at 12:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2228
- C:\Windows\system32\at.exe
  at 13:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:4596
- C:\Windows\system32\at.exe
  at 13:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2984
- C:\Windows\system32\at.exe
  at 13:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2656
- C:\Windows\system32\at.exe
  at 14:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:4636
- C:\Windows\system32\at.exe
  at 14:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:3452
- C:\Windows\system32\at.exe
  at 14:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2044
- C:\Windows\system32\at.exe
  at 15:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:3668
- C:\Windows\system32\at.exe
  at 15:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:3484
- C:\Windows\system32\at.exe
  at 15:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2744
- C:\Windows\system32\at.exe
  at 16:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:3316
- C:\Windows\system32\at.exe
  at 16:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:5016
- C:\Windows\system32\at.exe
  at 16:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1364
- C:\Windows\system32\at.exe
  at 17:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:1496
- C:\Windows\system32\at.exe
  at 17:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:4256
- C:\Windows\system32\at.exe
  at 17:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:396
- C:\Windows\system32\at.exe
  at 18:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2972
- C:\Windows\system32\at.exe
  at 18:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:3844
- C:\Windows\system32\at.exe
  at 18:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1848
- C:\Windows\system32\at.exe
  at 19:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:2208
- C:\Windows\system32\at.exe
  at 19:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2684
- C:\Windows\system32\at.exe
  at 19:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1808
- C:\Windows\system32\at.exe
  at 20:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:884
- C:\Windows\system32\at.exe
  at 20:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1288
- C:\Windows\system32\at.exe
  at 20:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:2312
- C:\Windows\system32\at.exe
  at 21:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:448
- C:\Windows\system32\at.exe
  at 21:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1560
- C:\Windows\system32\at.exe
  at 21:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:3604
- C:\Windows\system32\at.exe
  at 22:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:3384
- C:\Windows\system32\at.exe
  at 22:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:1400
- C:\Windows\system32\at.exe
  at 22:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:4488
- C:\Windows\system32\at.exe
  at 23:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:5020
- C:\Windows\system32\at.exe
  at 23:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:2396
- C:\Windows\system32\at.exe
  at 23:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:1152
- C:\Windows\system32\at.exe
  at 00:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
  2⤵
  PID:3056
- C:\Windows\system32\at.exe
  at 00:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
  2⤵
  PID:5036
- C:\Windows\system32\at.exe
  at 00:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
  2⤵
  PID:4296
- C:\Windows\system32\at.exe
  at 10:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:4984
- C:\Windows\system32\at.exe
  at 10:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
  2⤵
  PID:1424
- C:\Windows\system32\at.exe
  at 10:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
  2⤵
  PID:4056
- C:\Windows\system32\at.exe
  at 10:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:3632
- C:\Windows\system32\at.exe
  at 14:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1088
- C:\Windows\system32\at.exe
  at 14:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
  2⤵
  PID:1444
- C:\Windows\system32\at.exe
  at 14:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
  2⤵
  PID:2320
- C:\Windows\system32\at.exe
  at 14:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1540
- C:\Windows\system32\at.exe
  at 19:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1960
- C:\Windows\system32\at.exe
  at 19:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
  2⤵
  PID:3720
- C:\Windows\system32\at.exe
  at 19:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
  2⤵
  PID:1840
- C:\Windows\system32\at.exe
  at 19:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:1764
- C:\Windows\system32\at.exe
  at 21:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:4852
- C:\Windows\system32\at.exe
  at 21:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
  2⤵
  PID:4248
- C:\Windows\system32\at.exe
  at 21:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
  2⤵
  PID:3996
- C:\Windows\system32\at.exe
  at 21:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
  2⤵
  PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...