During our analysis, we observed one loader running “rr.exe” with the following arguments:open cmd.exe /c c:\\temp\\rr.exe SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spp.exe" iexploreThe “rr.exe” payload dropped to the system does nothing more than use the supplied command line arguments to create a registry key to execute the payload each time the system starts