Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 12:30

General

  • Target

    IDM/!)卸载.bat

  • Size

    14KB

  • MD5

    3decac4cda3e2c761b6c25a7c6afc8d6

  • SHA1

    857bac5e36b567021c39c90b0590aef558ae3f24

  • SHA256

    a058383a79b829bceeac7f183968adba2a38824c41f6d0bd3741ad9d753cf4d0

  • SHA512

    258efc5a8eca2d28a257783753a5c7242c8c5ea85e7d9c88515610d2e7c50eaa89164dc6fa3109fa3829604a67f88fa7ae2d63c11dbea0aca41cd19da6b4727a

  • SSDEEP

    384:4CFmoOfgEpLkHr5kkBQUsnLow8jS32AIF+uVF+uS:9r5kkBQxLow8jo2AL

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IDM\!)卸载.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\system32\reg.exe
      REG QUERY "HKU\S-1-5-19"
      2⤵
        PID:2948
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "IDM*" /T
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3112
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "IEMonitor.exe"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4164
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM "MediumILStart.exe"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4736
      • C:\Users\Admin\AppData\Local\Temp\IDM\idmBroker.exe
        "C:\Users\Admin\AppData\Local\Temp\IDM\idmBroker.exe" -RegServer
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:3560
      • C:\Users\Admin\AppData\Local\Temp\IDM\Uninstall.exe
        "C:\Users\Admin\AppData\Local\Temp\IDM\Uninstall.exe" -uninstdriv
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Windows\system32\RUNDLL32.EXE
          "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 C:\Users\Admin\AppData\Local\Temp\IDM\idmwfp.inf
          3⤵
          • Drops file in Drivers directory
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3528
          • C:\Windows\system32\runonce.exe
            "C:\Windows\system32\runonce.exe" -r
            4⤵
            • Checks processor information in registry
            • Suspicious use of WriteProcessMemory
            PID:2484
            • C:\Windows\System32\grpconv.exe
              "C:\Windows\System32\grpconv.exe" -o
              5⤵
                PID:4328
        • C:\Windows\system32\regsvr32.exe
          regsvr32 /s /u IDMIECC.dll
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Windows\SysWOW64\regsvr32.exe
            /s /u IDMIECC.dll
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1808
        • C:\Windows\system32\regsvr32.exe
          regsvr32 /s /u IDMIECC64.dll
          2⤵
            PID:2832
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s /u IDMGetAll.dll
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3268
            • C:\Windows\SysWOW64\regsvr32.exe
              /s /u IDMGetAll.dll
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1124
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s /u IDMGetAll64.dll
            2⤵
              PID:2004
            • C:\Windows\system32\regsvr32.exe
              regsvr32 /s /u IDMShellExt.dll
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3220
              • C:\Windows\SysWOW64\regsvr32.exe
                /s /u IDMShellExt.dll
                3⤵
                • System Location Discovery: System Language Discovery
                PID:520
            • C:\Windows\system32\regsvr32.exe
              regsvr32 /s /u IDMShellExt64.dll
              2⤵
                PID:4192
              • C:\Windows\system32\regsvr32.exe
                regsvr32 /s /u downlWithIDM.dll
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3164
                • C:\Windows\SysWOW64\regsvr32.exe
                  /s /u downlWithIDM.dll
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1592
              • C:\Windows\system32\regsvr32.exe
                regsvr32 /s /u downlWithIDM64.dll
                2⤵
                  PID:1424
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" ver"
                  2⤵
                    PID:3592
                  • C:\Windows\system32\findstr.exe
                    findstr "\<6\.[0-9]\.[0-9][0-9]*\> \<10\.[0-9]\.[0-9][0-9]*\>"
                    2⤵
                      PID:3104
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" ver"
                      2⤵
                        PID:3224
                      • C:\Windows\system32\findstr.exe
                        findstr "5\.[0-9]\.[0-9][0-9]*"
                        2⤵
                          PID:4284
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Download Manager" /f
                          2⤵
                            PID:3660
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Download Manager" /f /reg:32
                            2⤵
                              PID:2208
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\Software\DownloadManager" /f
                              2⤵
                                PID:2180
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\Software\Download Manager" /f
                                2⤵
                                  PID:1416
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\Software\DownloadManager" /f /reg:32
                                  2⤵
                                    PID:3020
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\Software\Download Manager" /f /reg:32
                                    2⤵
                                      PID:764
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\SOFTWARE\Internet Download Manager" /f
                                      2⤵
                                        PID:5024
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\SOFTWARE\Internet Download Manager" /f /reg:32
                                        2⤵
                                          PID:4524
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
                                          2⤵
                                            PID:2572
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan" /reg:32
                                            2⤵
                                              PID:4436
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter" /f
                                              2⤵
                                                PID:1488
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\SOFTWARE\Classes\Idmfsa.IDMEFSAgent" /f
                                                2⤵
                                                  PID:4764
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\SOFTWARE\Classes\Idmfsa.IDMEFSAgent.1" /f
                                                  2⤵
                                                    PID:1684
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\SOFTWARE\Classes\AppID\idmBroker.EXE" /f
                                                    2⤵
                                                    • Modifies registry class
                                                    PID:2448
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\SOFTWARE\Classes\idmBroker.OptionsReader" /f
                                                    2⤵
                                                    • Modifies registry class
                                                    PID:5060
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\SOFTWARE\Classes\idmBroker.OptionsReader.1" /f
                                                    2⤵
                                                    • Modifies registry class
                                                    PID:1564
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\SOFTWARE\Classes\AppID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
                                                    2⤵
                                                      PID:3096
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\SOFTWARE\Classes\AppID\{3C085E26-7DF6-4A34-ADA6-877D06BAE9A8}" /f
                                                      2⤵
                                                      • Modifies registry class
                                                      PID:2492
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
                                                      2⤵
                                                        PID:3824
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
                                                        2⤵
                                                          PID:4488
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\SOFTWARE\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
                                                          2⤵
                                                            PID:1044
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKLM\SOFTWARE\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
                                                            2⤵
                                                              PID:1672
                                                            • C:\Windows\system32\reg.exe
                                                              reg delete "HKLM\SOFTWARE\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
                                                              2⤵
                                                                PID:3908
                                                              • C:\Windows\system32\reg.exe
                                                                reg delete "HKLM\SOFTWARE\Classes\TypeLib\{5518B636-6884-48CA-A9A7-1CFD3F3BA916}" /f
                                                                2⤵
                                                                  PID:4992
                                                                • C:\Windows\system32\reg.exe
                                                                  reg delete "HKLM\SOFTWARE\Classes\TypeLib\{ECF21EAB-3AA8-4355-82BE-F777990001DD}" /f
                                                                  2⤵
                                                                    PID:1480
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKLM\SOFTWARE\Classes\TypeLib\{13D4E387-BAB7-47E7-B3D7-3F01ABC463EA}" /f
                                                                    2⤵
                                                                    • Modifies registry class
                                                                    PID:832
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKLM\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}" /f
                                                                    2⤵
                                                                    • Modifies registry class
                                                                    PID:5028
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKLM\SOFTWARE\Classes\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}" /f
                                                                    2⤵
                                                                      PID:4888
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg delete "HKLM\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}" /f
                                                                      2⤵
                                                                        PID:2156
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg delete "HKLM\SOFTWARE\Classes\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
                                                                        2⤵
                                                                          PID:4084
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg delete "HKLM\SOFTWARE\Classes\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}" /f
                                                                          2⤵
                                                                            PID:2536
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg delete "HKLM\SOFTWARE\Classes\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}" /f
                                                                            2⤵
                                                                              PID:768
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg delete "HKLM\SOFTWARE\Classes\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}" /f
                                                                              2⤵
                                                                                PID:5104
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg delete "HKLM\SOFTWARE\Classes\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
                                                                                2⤵
                                                                                  PID:2120
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg delete "HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f /reg:32
                                                                                  2⤵
                                                                                    PID:1520
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg delete "HKLM\SOFTWARE\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f /reg:32
                                                                                    2⤵
                                                                                      PID:932
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg delete "HKLM\SOFTWARE\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f /reg:32
                                                                                      2⤵
                                                                                        PID:3636
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg delete "HKLM\SOFTWARE\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f /reg:32
                                                                                        2⤵
                                                                                          PID:3624
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg delete "HKLM\SOFTWARE\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f /reg:32
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:1256
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg delete "HKLM\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}" /f /reg:32
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:4588
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg delete "HKLM\SOFTWARE\Classes\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}" /f /reg:32
                                                                                          2⤵
                                                                                            PID:3124
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg delete "HKLM\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}" /f /reg:32
                                                                                            2⤵
                                                                                              PID:2596
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg delete "HKLM\SOFTWARE\Classes\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f /reg:32
                                                                                              2⤵
                                                                                                PID:2412
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg delete "HKLM\SOFTWARE\Classes\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}" /f /reg:32
                                                                                                2⤵
                                                                                                  PID:3180
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg delete "HKLM\SOFTWARE\Classes\Interface\{94D09862-1875-4FC9-B434-91CF25C840A1}" /f /reg:32
                                                                                                  2⤵
                                                                                                    PID:3472
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg delete "HKLM\SOFTWARE\Classes\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}" /f /reg:32
                                                                                                    2⤵
                                                                                                      PID:1952
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg delete "HKLM\SOFTWARE\Classes\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f /reg:32
                                                                                                      2⤵
                                                                                                        PID:1032
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg delete "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                        2⤵
                                                                                                          PID:4356
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg delete "HKLM\SOFTWARE\Google\Chrome\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f
                                                                                                          2⤵
                                                                                                            PID:4912
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg delete "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.tonec.idm" /f /reg:32
                                                                                                            2⤵
                                                                                                              PID:3728
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg delete "HKLM\SOFTWARE\Google\Chrome\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f /reg:32
                                                                                                              2⤵
                                                                                                                PID:2308
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg delete "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4" /f
                                                                                                                2⤵
                                                                                                                  PID:2500
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI"
                                                                                                                  2⤵
                                                                                                                    PID:2292
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}" /f
                                                                                                                    2⤵
                                                                                                                      PID:3452
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f
                                                                                                                      2⤵
                                                                                                                        PID:3912
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
                                                                                                                        2⤵
                                                                                                                          PID:2856
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:3532
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}" /f /reg:32
                                                                                                                            2⤵
                                                                                                                              PID:4736
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f /reg:32
                                                                                                                              2⤵
                                                                                                                                PID:4140
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f /reg:32
                                                                                                                                2⤵
                                                                                                                                  PID:3708
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg delete "HKLM\SOFTWARE\Microsoft\Tracing\IDMan_RASAPI32" /f
                                                                                                                                  2⤵
                                                                                                                                    PID:1164
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg delete "HKLM\SOFTWARE\Microsoft\Tracing\IDMan_RASAPI32" /f /reg:32
                                                                                                                                    2⤵
                                                                                                                                      PID:3028
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState" /f /v "PolicyState" /t REG_DWORD /d "2"
                                                                                                                                      2⤵
                                                                                                                                        PID:2416
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
                                                                                                                                        2⤵
                                                                                                                                          PID:4564
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg delete "HKCU\SOFTWARE\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
                                                                                                                                          2⤵
                                                                                                                                            PID:3664
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg delete "HKCU\SOFTWARE\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /reg:32 /f
                                                                                                                                            2⤵
                                                                                                                                              PID:4664
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg delete "HKCU\SOFTWARE\Classes\CLSID\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
                                                                                                                                              2⤵
                                                                                                                                                PID:4956
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg delete "HKCU\SOFTWARE\CocCoc\Browser\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:4652
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg delete "HKCU\SOFTWARE\CocCoc\Browser\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1248
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg delete "HKCU\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4708
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg delete "HKCU\SOFTWARE\Microsoft\Edge\Extensions\llbjbkhnmlidjebalopleeepgdfgcpec" /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2140
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1680
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:32
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5092
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪" /f
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3820
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪╚½▓┐┴┤╜╙" /f
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3156
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg delete "HKCU\SOFTWARE\Mozilla\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1900
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg delete "HKCU\SOFTWARE\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3276
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg delete "HKCU\SOFTWARE\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3732
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}" /f
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2000
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}" /f
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                        PID:2884
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}" /f
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1220
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3048
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            reg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:392
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f /reg:32
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4388
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic userAccount where "Name='Admin'" get SID /value
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2124
                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                    wmic userAccount where "Name='Admin'" get SID /value
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:1124
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "IDMan"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2264
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer" /f /v "DownloadUI"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3840
                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                      reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer" /f /v "DownloadUI" /reg:32
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3932
                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                        reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪" /f
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2004
                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                          reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\MenuExt\╩╣╙├ IDM ╧┬╘╪╚½▓┐┴┤╜╙" /f
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4724
                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                            reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\CocCoc\Browser\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3888
                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                              reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\CocCoc\Browser\Extensions\ngpampappnmepgilojfohadhhmbhlaek" /f
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3220
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Edge\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2104
                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                  reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Edge\Extensions\llbjbkhnmlidjebalopleeepgdfgcpec" /f
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:116
                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                    reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Mozilla\NativeMessagingHosts\com.tonec.idm" /f
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:660
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Mozilla\SeaMonkey\Extensions" /f /v "[email protected]"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                          reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f /reg:32
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2672
                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                              reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}" /f
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1424
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}" /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                  reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}" /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg delete "HKU\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}" /f
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3224
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg delete "HKCU\Software\DownloadManager" /f /v "MData"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3104
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        reg delete "HKCU\Software\DownloadManager" /f /v "Email"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:772
                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                          reg delete "HKCU\Software\DownloadManager" /f /v "LName"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3996
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg delete "HKCU\Software\DownloadManager" /f /v "FName"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg delete "HKCU\Software\DownloadManager" /f /v "Serial"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:3416
                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                reg delete "HKCU\Software\DownloadManager" /f /v "tvfrdt"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                  reg delete "HKCU\Software\DownloadManager" /f /v "scansk"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    reg delete "HKCU\Software\DownloadManager" /f /v "idmvers"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1204
                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                      reg delete "HKCU\Software\DownloadManager" /f /v "ExePath"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3572
                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                        reg delete "HKCU\Software\DownloadManager" /f /v "TempPath"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:2992
                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                          reg delete "HKCU\Software\DownloadManager" /f /v "LstCheck"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:744
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg delete "HKCU\Software\DownloadManager" /f /v "CheckUpdtVM"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3556
                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                              reg delete "HKCU\Software\DownloadManager" /f /v "AppDataIDMFolder"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:3600
                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                reg delete "HKCU\Software\DownloadManager" /f /v "CommonAppDataIDMFolder"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2664
                                                                                                                                                                                                                                                • C:\Windows\regedit.exe
                                                                                                                                                                                                                                                  regedit /e "!)╤í╧ε┼Σ╓├.reg" HKEY_CURRENT_USER\Software\DownloadManager
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Runs .reg file with regedit
                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                • C:\Windows\system32\choice.exe
                                                                                                                                                                                                                                                  CHOICE /C 12 /N
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:4544

                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                • memory/1380-0-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  164KB

                                                                                                                                                                                                                                                • memory/1380-2-0x0000000000400000-0x0000000000429000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  164KB