Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 06:43

General

  • Target

    IDM/!)??.bat

  • Size

    15KB

  • MD5

    8977acec22d71c30c123e01243728b28

  • SHA1

    ef3d08cb61cf091505b3b2c2b689556bc327ecaa

  • SHA256

    7091a1fcc99bc61213ae109dcde8c6a044718351b4bb5bfa80cec692e78e8e5e

  • SHA512

    de859ca413924f4a5a61ab4a847bf4cd8de58ea9616fb7cc63369ab4f3bdd4b16d21884e6efdccb445d9ae8068ecaabdd9c93c575e4be6b807059bbfa19ab6a4

  • SSDEEP

    384:MCFmoOfgEBLkHr5kkBQUsnLow8j/GkAyF+uVF+uS:Hr5kkBQxLow8jukAF

Score
1/10

Malware Config

Signatures

  • Kills process with taskkill 5 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IDM\!)__.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Windows\system32\reg.exe
      REG QUERY "HKU\S-1-5-19"
      2⤵
        PID:4592
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "IDM*" /T
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2364
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "IEMonitor.exe"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2220
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "IDMMsgHost.exe"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4616
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "MediumILStart.exe"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3012
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "IDMIntegrator64.exe"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3588
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" ver"
        2⤵
          PID:412
        • C:\Windows\system32\findstr.exe
          findstr "\<6\.[0-9]\.[0-9][0-9]*\> \<10\.[0-9]\.[0-9][0-9]*\>"
          2⤵
            PID:4396
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" ver"
            2⤵
              PID:3432
            • C:\Windows\system32\findstr.exe
              findstr "5\.[0-9]\.[0-9][0-9]*"
              2⤵
                PID:2868
              • C:\Windows\system32\reg.exe
                reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Download Manager" /f
                2⤵
                  PID:4100
                • C:\Windows\system32\reg.exe
                  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Download Manager" /f /reg:32
                  2⤵
                    PID:2828
                  • C:\Windows\system32\reg.exe
                    reg delete "HKLM\Software\DownloadManager" /f
                    2⤵
                      PID:392
                    • C:\Windows\system32\reg.exe
                      reg delete "HKLM\Software\Download Manager" /f
                      2⤵
                        PID:3252
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\Software\DownloadManager" /f /reg:32
                        2⤵
                          PID:1468
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\Software\Download Manager" /f /reg:32
                          2⤵
                            PID:1008
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\SOFTWARE\Internet Download Manager" /f
                            2⤵
                              PID:2584
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\SOFTWARE\Internet Download Manager" /f /reg:32
                              2⤵
                                PID:2304
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
                                2⤵
                                  PID:3936
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan" /reg:32
                                  2⤵
                                    PID:2460
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter" /f
                                    2⤵
                                      PID:2832
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\SOFTWARE\Classes\Idmfsa.IDMEFSAgent" /f
                                      2⤵
                                        PID:2784
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\SOFTWARE\Classes\Idmfsa.IDMEFSAgent.1" /f
                                        2⤵
                                          PID:2524
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\SOFTWARE\Classes\AppID\idmBroker.EXE" /f
                                          2⤵
                                            PID:2272
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\SOFTWARE\Classes\idmBroker.OptionsReader" /f
                                            2⤵
                                              PID:2904
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\SOFTWARE\Classes\idmBroker.OptionsReader.1" /f
                                              2⤵
                                                PID:2884
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\SOFTWARE\Classes\AppID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
                                                2⤵
                                                  PID:4104
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\SOFTWARE\Classes\AppID\{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8}" /f
                                                  2⤵
                                                    PID:4644
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
                                                    2⤵
                                                      PID:2844
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
                                                      2⤵
                                                        PID:4948
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\SOFTWARE\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
                                                        2⤵
                                                          PID:3284
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\SOFTWARE\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
                                                          2⤵
                                                            PID:5060
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKLM\SOFTWARE\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
                                                            2⤵
                                                              PID:2340
                                                            • C:\Windows\system32\reg.exe
                                                              reg delete "HKLM\SOFTWARE\Classes\TypeLib\{5518B636-6884-48CA-A9A7-1CFD3F3BA916}" /f
                                                              2⤵
                                                                PID:4044
                                                              • C:\Windows\system32\reg.exe
                                                                reg delete "HKLM\SOFTWARE\Classes\TypeLib\{ECF21EAB-3AA8-4355-82BE-F777990001DD}" /f
                                                                2⤵
                                                                  PID:3564
                                                                • C:\Windows\system32\reg.exe
                                                                  reg delete "HKLM\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}" /f
                                                                  2⤵
                                                                    PID:2200
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKLM\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}" /f
                                                                    2⤵
                                                                      PID:312
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg delete "HKLM\SOFTWARE\Classes\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}" /f
                                                                      2⤵
                                                                        PID:4212
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg delete "HKLM\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}" /f
                                                                        2⤵
                                                                          PID:1912
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg delete "HKLM\SOFTWARE\Classes\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
                                                                          2⤵
                                                                            PID:4944
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg delete "HKLM\SOFTWARE\Classes\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}" /f
                                                                            2⤵
                                                                              PID:1980
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg delete "HKLM\SOFTWARE\Classes\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}" /f
                                                                              2⤵
                                                                                PID:2708
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg delete "HKLM\SOFTWARE\Classes\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}" /f
                                                                                2⤵
                                                                                  PID:1996
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg delete "HKLM\SOFTWARE\Classes\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
                                                                                  2⤵
                                                                                    PID:3896
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f /reg:32
                                                                                    2⤵
                                                                                      PID:4732
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg delete "HKLM\SOFTWARE\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f /reg:32
                                                                                      2⤵
                                                                                        PID:4048
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg delete "HKLM\SOFTWARE\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f /reg:32
                                                                                        2⤵
                                                                                          PID:4804
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg delete "HKLM\SOFTWARE\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f /reg:32
                                                                                          2⤵
                                                                                            PID:4308
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg delete "HKLM\SOFTWARE\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f /reg:32
                                                                                            2⤵
                                                                                              PID:1576
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg delete "HKLM\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}" /f /reg:32
                                                                                              2⤵
                                                                                                PID:3980
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg delete "HKLM\SOFTWARE\Classes\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}" /f /reg:32
                                                                                                2⤵
                                                                                                  PID:1872
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg delete "HKLM\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}" /f /reg:32
                                                                                                  2⤵
                                                                                                    PID:4568
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg delete "HKLM\SOFTWARE\Classes\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f /reg:32
                                                                                                    2⤵
                                                                                                      PID:2860
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg delete "HKLM\SOFTWARE\Classes\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}" /f /reg:32
                                                                                                      2⤵
                                                                                                        PID:1944
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg delete "HKLM\SOFTWARE\Classes\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}" /f /reg:32
                                                                                                        2⤵
                                                                                                          PID:1240
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg delete "HKLM\SOFTWARE\Classes\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}" /f /reg:32
                                                                                                          2⤵
                                                                                                            PID:2000
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg delete "HKLM\SOFTWARE\Classes\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f /reg:32
                                                                                                            2⤵
                                                                                                              PID:100
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg delete "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                              2⤵
                                                                                                                PID:916
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg delete "HKLM\SOFTWARE\Google\Chrome\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f
                                                                                                                2⤵
                                                                                                                  PID:1412
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg delete "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.tonec.idm" /f /reg:32
                                                                                                                  2⤵
                                                                                                                    PID:3264
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg delete "HKLM\SOFTWARE\Google\Chrome\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f /reg:32
                                                                                                                    2⤵
                                                                                                                      PID:1824
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg delete "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4" /f
                                                                                                                      2⤵
                                                                                                                        PID:1112
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI"
                                                                                                                        2⤵
                                                                                                                          PID:1088
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}" /f
                                                                                                                          2⤵
                                                                                                                            PID:1276
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f
                                                                                                                            2⤵
                                                                                                                              PID:4132
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
                                                                                                                              2⤵
                                                                                                                                PID:1060
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:32
                                                                                                                                2⤵
                                                                                                                                  PID:2608
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}" /f /reg:32
                                                                                                                                  2⤵
                                                                                                                                    PID:208
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f /reg:32
                                                                                                                                    2⤵
                                                                                                                                      PID:4736
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f /reg:32
                                                                                                                                      2⤵
                                                                                                                                        PID:3920
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg delete "HKLM\SOFTWARE\Microsoft\Tracing\IDMan_RASAPI32" /f
                                                                                                                                        2⤵
                                                                                                                                          PID:8
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg delete "HKLM\SOFTWARE\Microsoft\Tracing\IDMan_RASAPI32" /f /reg:32
                                                                                                                                          2⤵
                                                                                                                                            PID:2656
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState" /f /v "PolicyState" /t REG_DWORD /d "2"
                                                                                                                                            2⤵
                                                                                                                                              PID:4344
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
                                                                                                                                              2⤵
                                                                                                                                                PID:2240
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg delete "HKCU\SOFTWARE\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:4536
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg delete "HKCU\SOFTWARE\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /reg:32 /f
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3604
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg delete "HKCU\SOFTWARE\Classes\CLSID\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4412
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg delete "HKCU\SOFTWARE\CocCoc\Browser\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4768
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg delete "HKCU\SOFTWARE\CocCoc\Browser\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2768
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg delete "HKCU\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4032
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg delete "HKCU\SOFTWARE\Microsoft\Edge\Extensions\llbjbkhnmlidjebalopleeepgdfgcpec" /f
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5076
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4404
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:32
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1520
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪" /f
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4064
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪╚½▓┐┴┤╜╙" /f
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2360
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg delete "HKCU\SOFTWARE\Mozilla\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3628
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg delete "HKCU\SOFTWARE\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3556
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          reg delete "HKCU\SOFTWARE\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1340
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}" /f
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:2232
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}" /f
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4496
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}" /f
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3156
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4208
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1536
                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                      reg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f /reg:32
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1900
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic userAccount where "Name='Admin'" get SID /value
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3852
                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                            wmic userAccount where "Name='Admin'" get SID /value
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:4604
                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                          reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1708
                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                            reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer" /f /v "DownloadUI"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4832
                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                              reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:32
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2864
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪" /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2024
                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                  reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪╚½▓┐┴┤╜╙" /f
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                    reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\CocCoc\Browser\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4436
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\CocCoc\Browser\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Edge\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                          reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Edge\Extensions\llbjbkhnmlidjebalopleeepgdfgcpec" /f
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:948
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Mozilla\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:368
                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                              reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3836
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3448
                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                  reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:964
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f /reg:32
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:936
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}" /f
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}" /f
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                          reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}" /f
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4320
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg delete "HKU\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:412
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg delete "HKCU\Software\DownloadManager" /f /v "MData"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:2236
                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                reg delete "HKCU\Software\DownloadManager" /f /v "LName"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4004
                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                  reg delete "HKCU\Software\DownloadManager" /f /v "FName"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1408
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    reg delete "HKCU\Software\DownloadManager" /f /v "Email"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2068
                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                      reg delete "HKCU\Software\DownloadManager" /f /v "Serial"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:880
                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                        reg delete "HKCU\Software\DownloadManager" /f /v "vCOUFP"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:392
                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                          reg delete "HKCU\Software\DownloadManager" /f /v "scansk"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:3252
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg delete "HKCU\Software\DownloadManager" /f /v "tvfrdt"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1468
                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                              reg delete "HKCU\Software\DownloadManager" /f /v "radxcnt"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1008
                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                reg delete "HKCU\Software\DownloadManager" /f /v "idmvers"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:3356
                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                  reg delete "HKCU\Software\DownloadManager" /f /v "ExePath"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                    reg delete "HKCU\Software\DownloadManager" /f /v "TempPath"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:3080
                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                      reg delete "HKCU\Software\DownloadManager" /f /v "LstCheck"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1544
                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                        reg delete "HKCU\Software\DownloadManager" /f /v "ptrk_scdt"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                          reg delete "HKCU\Software\DownloadManager" /f /v "LastCheckQU"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:2528
                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                            reg delete "HKCU\Software\DownloadManager" /f /v "CheckUpdtVM"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1364
                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                              reg delete "HKCU\Software\DownloadManager" /f /v "TipTimeStamp"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:884
                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                reg delete "HKCU\Software\DownloadManager" /f /v "AppDataIDMFolder"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                  reg delete "HKCU\Software\DownloadManager" /f /v "CommonAppDataIDMFolder"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3132
                                                                                                                                                                                                                                                                  • C:\Windows\regedit.exe
                                                                                                                                                                                                                                                                    regedit /e "!)╤í╧ε┼Σ╓├.reg" HKEY_CURRENT_USER\Software\DownloadManager
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Runs .reg file with regedit
                                                                                                                                                                                                                                                                    PID:2844
                                                                                                                                                                                                                                                                  • C:\Windows\system32\choice.exe
                                                                                                                                                                                                                                                                    CHOICE /C 12 /N
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:2060

                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                  MITRE ATT&CK Matrix

                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                  Downloads