fc3e5dea36ee2077428afc6697a6c82cadd7193505780380bc0902d2f71ca1e6

Analysis

max time kernel
26s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
Size 632KB
Sample261012-1f6hsafw2v
SHA256 fc3e5dea36ee2077428afc6697a6c82cadd7193505780380bc0902d2f71ca1e6
MD5 651b1cafa923cf37d484346841438030
SHA1 510feaf25c504164ee99dc1625921c6611443790
SHA512 f44348864288beb257609f973a6299746275403e12c2624967dc5a17ae1b2bc4158492a1d29c62b22e15b14ef7b72afba543252f74cd5e714eebad6d1ebd3105
SSDEEP 12288:r3TdtLW5WIj1YSSdFxJBSXyMzBUWb9lx/RAHHLo8OW+rB/:rDsj1dEZBcJ9nPx/GHrp+9
TLSH
T1B5D40102212AF5E4E82C8837264731F51BD56D655D0BEE2130ADFF3B78762F4AD0A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe regsvr.exe"	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe regsvr.exe"	regsvr.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regsvr.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 1 IoCs

pid	Process
4660	regsvr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Msn Messsenger = "C:\\Windows\\system32\\regsvr.exe"	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Msn Messsenger = "C:\\Windows\\system32\\regsvr.exe"	regsvr.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	regsvr.exe
File opened (read-only)	\??\y:	regsvr.exe
File opened (read-only)	\??\q:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\i:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\l:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\r:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\w:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\d:	regsvr.exe
File opened (read-only)	\??\p:	regsvr.exe
File opened (read-only)	\??\q:	regsvr.exe
File opened (read-only)	\??\h:	regsvr.exe
File opened (read-only)	\??\b:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\k:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\n:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\v:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\n:	regsvr.exe
File opened (read-only)	\??\t:	regsvr.exe
File opened (read-only)	\??\v:	regsvr.exe
File opened (read-only)	\??\t:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\a:	regsvr.exe
File opened (read-only)	\??\b:	regsvr.exe
File opened (read-only)	\??\j:	regsvr.exe
File opened (read-only)	\??\l:	regsvr.exe
File opened (read-only)	\??\z:	regsvr.exe
File opened (read-only)	\??\u:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\g:	regsvr.exe
File opened (read-only)	\??\k:	regsvr.exe
File opened (read-only)	\??\x:	regsvr.exe
File opened (read-only)	\??\d:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\m:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\p:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\y:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\r:	regsvr.exe
File opened (read-only)	\??\s:	regsvr.exe
File opened (read-only)	\??\w:	regsvr.exe
File opened (read-only)	\??\a:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\s:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\u:	regsvr.exe
File opened (read-only)	\??\g:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\j:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\o:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\x:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\z:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\h:	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened (read-only)	\??\i:	regsvr.exe
File opened (read-only)	\??\m:	regsvr.exe

AutoIT Executable 30 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5408-20-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-21-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-22-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-23-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-24-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-25-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-26-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-27-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-28-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-29-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-30-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-31-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-32-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-33-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-34-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-35-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-37-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-36-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-38-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-39-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-40-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-41-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-42-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-43-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-44-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-45-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-46-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-47-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/5408-48-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe
behavioral2/memory/4660-49-0x0000000000400000-0x00000000004C3000-memory.dmp	autoit_exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\setting.ini	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File created	C:\Windows\SysWOW64\regsvr.exe	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\SysWOW64\setup.ini	regsvr.exe
File opened for modification	C:\Windows\SysWOW64\28463\svchost.001	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\SysWOW64\regsvr.exe	regsvr.exe
File created	C:\Windows\SysWOW64\28463\svchost.001	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\SysWOW64\setup.ini	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\SysWOW64\28463	regsvr.exe
File opened for modification	C:\Windows\SysWOW64\setting.ini	regsvr.exe
File opened for modification	C:\Windows\SysWOW64\setting.ini	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\SysWOW64\28463	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\SysWOW64\regsvr.exe	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File created	C:\Windows\SysWOW64\svchost .exe	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\SysWOW64\svchost .exe	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\SysWOW64\svchost .exe	regsvr.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\regsvr.exe	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\regsvr.exe	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
File opened for modification	C:\Windows\regsvr.exe	regsvr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3128	cmd.exe
2244	cmd.exe
5320	cmd.exe
5072	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	regsvr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	regsvr.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4660	regsvr.exe
4660	regsvr.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
4660	regsvr.exe
4660	regsvr.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
4660	regsvr.exe
4660	regsvr.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
4660	regsvr.exe
4660	regsvr.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
4660	regsvr.exe
4660	regsvr.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
4660	regsvr.exe
4660	regsvr.exe
4660	regsvr.exe
4660	regsvr.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
4660	regsvr.exe
4660	regsvr.exe
4660	regsvr.exe
4660	regsvr.exe
4660	regsvr.exe
4660	regsvr.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
4660	regsvr.exe
4660	regsvr.exe
4660	regsvr.exe
4660	regsvr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4416	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5408 wrote to memory of 5072	5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe	89
PID 5072 wrote to memory of 4516	5072	cmd.exe	91
PID 5408 wrote to memory of 3128	5408	jaffacakes118_Worm.Win32.AutoRun.dtbv.exe	94
PID 3128 wrote to memory of 3236	3128	cmd.exe	97
PID 4416 wrote to memory of 4660	4416	explorer.exe	99
PID 4660 wrote to memory of 2244	4660	regsvr.exe	100
PID 2244 wrote to memory of 3700	2244	cmd.exe	102
PID 4660 wrote to memory of 5320	4660	regsvr.exe	103
PID 5320 wrote to memory of 6024	5320	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.AutoRun.dtbv.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.AutoRun.dtbv.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3236

C:\Windows\explorer.exe
Explorer.exe regsvr.exe
1⤵
PID:4608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\regsvr.exe
  "C:\Windows\regsvr.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT /delete /yes
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\SysWOW64\at.exe
      AT /delete /yes
      4⤵
      System Location Discovery: System Language Discovery
      PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5320
  - - C:\Windows\SysWOW64\at.exe
      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 cc505c474f8baab6c1a796c0b2f7f4abef1570d77abd97094990d9adef1d7885
MD5 0b0ec08ee3964818deec746162610240
SHA1 18a22e30b658a151157e9f69eb9b855e2071f937
SHA512 94eea6787c376378b0f0455976e1d9f907e92c82380d6e74a7e998c35f21cac814731c5b80fbffe4e460d1d5483fe15b51def239de7f07d3874eff34af8543dd
TLSH
T10CF0DC43D829B6812E4508D81A8FE5383230E07E04A28181B57C18F644547BFAA3D038
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 c2e2907d1c812fbef77e72c971a0126c164c7408ae5b1d91caf4957a54a33bb5
MD5 d6dc6b0d1179679612db94a3954f1e1e
SHA1 4ceaa94d2411400d18d3572e5f329e7102a2b227
SHA512 3f1547b5a99e0b8c766acc356c2528536c2b00965e9c42df5ad9a4002e0e2123bbd16392a318552415ddf69419d6e53fb194d299b3aaacf427c214dabc8a08e1
TLSH
T155E0C02802F7411CF4E4D0394BCE7031556DF1150467E2741EC89B04F72AA00FC02A26
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ini

Path C:\Windows\SysWOW64\setup.ini
Size 96B
SHA256 69815d4932ddde240ce6b1353305d2fab58ca402e9c478452c8e37ce8a7b2ac9
MD5 9ece103c47335f0cc777f1132b8d522f
SHA1 63afa171c64f86d99db81723e1335e960e85fa43
SHA512 b1ac64c71c6338bf0ab33df938128822da680f20d0552edb2edb808f1c75bafb88467412fc8dc60ed8022a1f0c4f3fcbecb69a320ec871b3a766482f32d6eb05
TLSH
T100B00205F5594194154DB8049B8005F1B553D96115694F1253A958691290168E719A4B
MD5 SHA1 SHA512 TLSH

Submit Download

regsvr.exe

Path C:\Windows\regsvr.exe
Size 632KB
SHA256 fc3e5dea36ee2077428afc6697a6c82cadd7193505780380bc0902d2f71ca1e6
MD5 651b1cafa923cf37d484346841438030
SHA1 510feaf25c504164ee99dc1625921c6611443790
SHA512 f44348864288beb257609f973a6299746275403e12c2624967dc5a17ae1b2bc4158492a1d29c62b22e15b14ef7b72afba543252f74cd5e714eebad6d1ebd3105
SSDEEP 12288:r3TdtLW5WIj1YSSdFxJBSXyMzBUWb9lx/RAHHLo8OW+rB/:rDsj1dEZBcJ9nPx/GHrp+9
TLSH
T1B5D40102212AF5E4E82C8837264731F51BD56D655D0BEE2130ADFF3B78762F4AD0A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4660-41-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-37-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-21-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-49-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-23-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-47-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-25-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-45-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-27-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-43-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-29-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-39-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-31-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-36-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/4660-33-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-34-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-28-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-20-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-32-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-38-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-30-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-40-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-42-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-35-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-44-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-26-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-46-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-24-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-48-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-22-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/5408-50-0x0000000000400000-0x00000000004C3000-memory.dmp

Download