warzonerat | 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6

Analysis

max time kernel
151s
max time network
147s
platform
windows7_x64
resource
win7v20201028
submitted
15/11/2020, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
Size 2.9MB
Sample201115-399pl5xpr2
SHA256 10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6
MD5 a5ac324a441a5b9911fb2b8010d96f7e
SHA1 44720945197795ddc50ece473deed81cc331b9a8
SHA512 144358eb81c0de7b2b0b9d7a66528639bc72f69462d87381debe73d9cf40b77446607b1820ca637da4051a34ef9da24e2f1f8aa5ff41c2b513b67fac93c2c2c2
MD5 SHA1 SHA512

Score

10^/10

warzonerat xmrig evasion infostealer miner persistence rat upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Warzone RAT Payload 38 IoCs

rat

resource	yara_rule
behavioral1/files/0x00040000000130ee-17.dat	warzonerat
behavioral1/files/0x00040000000130ee-21.dat	warzonerat
behavioral1/files/0x00040000000130ee-19.dat	warzonerat
behavioral1/files/0x00040000000130ee-22.dat	warzonerat
behavioral1/files/0x00040000000130ee-28.dat	warzonerat
behavioral1/files/0x00030000000130ec-38.dat	warzonerat
behavioral1/files/0x00030000000130eb-37.dat	warzonerat
behavioral1/files/0x00040000000130ee-35.dat	warzonerat
behavioral1/files/0x00050000000130ec-45.dat	warzonerat
behavioral1/files/0x00050000000130ec-48.dat	warzonerat
behavioral1/files/0x00050000000130ec-46.dat	warzonerat
behavioral1/files/0x00050000000130ec-49.dat	warzonerat
behavioral1/files/0x00050000000130ec-52.dat	warzonerat
behavioral1/files/0x00050000000130ec-56.dat	warzonerat
behavioral1/files/0x00050000000130ec-62.dat	warzonerat
behavioral1/files/0x00050000000130ec-64.dat	warzonerat
behavioral1/files/0x00050000000130ec-66.dat	warzonerat
behavioral1/files/0x00050000000130ec-69.dat	warzonerat
behavioral1/files/0x00050000000130ec-74.dat	warzonerat
behavioral1/files/0x00050000000130ec-80.dat	warzonerat
behavioral1/files/0x00050000000130ec-78.dat	warzonerat
behavioral1/files/0x00050000000130ec-82.dat	warzonerat
behavioral1/files/0x00050000000130ec-86.dat	warzonerat
behavioral1/files/0x00050000000130ec-90.dat	warzonerat
behavioral1/files/0x00050000000130ec-94.dat	warzonerat
behavioral1/files/0x00050000000130ec-96.dat	warzonerat
behavioral1/files/0x00050000000130ec-98.dat	warzonerat
behavioral1/files/0x00050000000130ec-100.dat	warzonerat
behavioral1/files/0x00050000000130ec-113.dat	warzonerat
behavioral1/files/0x00050000000130ec-111.dat	warzonerat
behavioral1/files/0x00050000000130ec-109.dat	warzonerat
behavioral1/files/0x00050000000130ec-105.dat	warzonerat
behavioral1/files/0x00050000000130ec-117.dat	warzonerat
behavioral1/files/0x00050000000130ec-121.dat	warzonerat
behavioral1/files/0x00050000000130ec-129.dat	warzonerat
behavioral1/files/0x00050000000130ec-127.dat	warzonerat
behavioral1/files/0x00050000000130ec-125.dat	warzonerat
behavioral1/files/0x00050000000130ec-131.dat	warzonerat

Executes dropped EXE 15 IoCs

pid	Process
564	explorer.exe
924	explorer.exe
512	explorer.exe
1636	spoolsv.exe
1908	spoolsv.exe
1932	spoolsv.exe
328	spoolsv.exe
1864	spoolsv.exe
1444	spoolsv.exe
428	spoolsv.exe
960	spoolsv.exe
1872	spoolsv.exe
888	spoolsv.exe
1868	spoolsv.exe
748	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000130ee-17.dat	upx
behavioral1/files/0x00040000000130ee-21.dat	upx
behavioral1/files/0x00040000000130ee-19.dat	upx
behavioral1/files/0x00040000000130ee-22.dat	upx
behavioral1/files/0x00040000000130ee-28.dat	upx
behavioral1/files/0x00030000000130ec-38.dat	upx
behavioral1/files/0x00030000000130eb-37.dat	upx
behavioral1/files/0x00040000000130ee-35.dat	upx
behavioral1/files/0x00050000000130ec-45.dat	upx
behavioral1/files/0x00050000000130ec-48.dat	upx
behavioral1/files/0x00050000000130ec-46.dat	upx
behavioral1/files/0x00050000000130ec-49.dat	upx
behavioral1/files/0x00050000000130ec-52.dat	upx
behavioral1/files/0x00050000000130ec-56.dat	upx
behavioral1/files/0x00050000000130ec-62.dat	upx
behavioral1/files/0x00050000000130ec-64.dat	upx
behavioral1/files/0x00050000000130ec-66.dat	upx
behavioral1/files/0x00050000000130ec-69.dat	upx
behavioral1/files/0x00050000000130ec-74.dat	upx
behavioral1/files/0x00050000000130ec-80.dat	upx
behavioral1/files/0x00050000000130ec-78.dat	upx
behavioral1/files/0x00050000000130ec-82.dat	upx
behavioral1/files/0x00050000000130ec-86.dat	upx
behavioral1/files/0x00050000000130ec-90.dat	upx
behavioral1/files/0x00050000000130ec-94.dat	upx
behavioral1/files/0x00050000000130ec-96.dat	upx
behavioral1/files/0x00050000000130ec-98.dat	upx
behavioral1/files/0x00050000000130ec-100.dat	upx
behavioral1/files/0x00050000000130ec-113.dat	upx
behavioral1/files/0x00050000000130ec-111.dat	upx
behavioral1/files/0x00050000000130ec-109.dat	upx
behavioral1/files/0x00050000000130ec-105.dat	upx
behavioral1/files/0x00050000000130ec-117.dat	upx
behavioral1/files/0x00050000000130ec-121.dat	upx
behavioral1/files/0x00050000000130ec-129.dat	upx
behavioral1/files/0x00050000000130ec-127.dat	upx
behavioral1/files/0x00050000000130ec-125.dat	upx
behavioral1/files/0x00050000000130ec-131.dat	upx
behavioral1/files/0x00050000000130ec-141.dat	upx
behavioral1/files/0x00050000000130ec-139.dat	upx
behavioral1/files/0x00050000000130ec-137.dat	upx

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Loads dropped DLL 22 IoCs

pid	Process
580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
512	explorer.exe
512	explorer.exe
1636	spoolsv.exe
512	explorer.exe
512	explorer.exe
1932	spoolsv.exe
512	explorer.exe
512	explorer.exe
1864	spoolsv.exe
512	explorer.exe
512	explorer.exe
428	spoolsv.exe
512	explorer.exe
512	explorer.exe
1872	spoolsv.exe
512	explorer.exe
512	explorer.exe
1868	spoolsv.exe
512	explorer.exe
512	explorer.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 844 set thread context of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 1956 set thread context of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 set thread context of 772	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	33
PID 564 set thread context of 924	564	explorer.exe	37
PID 924 set thread context of 512	924	explorer.exe	38
PID 924 set thread context of 1468	924	explorer.exe	39
PID 1636 set thread context of 1908	1636	spoolsv.exe	43
PID 1932 set thread context of 328	1932	spoolsv.exe	47
PID 1864 set thread context of 1444	1864	spoolsv.exe	51
PID 428 set thread context of 960	428	spoolsv.exe	55
PID 1872 set thread context of 888	1872	spoolsv.exe	59
PID 1868 set thread context of 1492	1868	spoolsv.exe	63

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
564	explorer.exe
1636	spoolsv.exe
512	explorer.exe
512	explorer.exe
1932	spoolsv.exe
512	explorer.exe
1864	spoolsv.exe
512	explorer.exe
428	spoolsv.exe
512	explorer.exe
1872	spoolsv.exe
512	explorer.exe
1868	spoolsv.exe
512	explorer.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
564	explorer.exe
564	explorer.exe
512	explorer.exe
512	explorer.exe
1636	spoolsv.exe
1636	spoolsv.exe
512	explorer.exe
512	explorer.exe
1932	spoolsv.exe
1932	spoolsv.exe
1864	spoolsv.exe
1864	spoolsv.exe
428	spoolsv.exe
428	spoolsv.exe
1872	spoolsv.exe
1872	spoolsv.exe
1868	spoolsv.exe
1868	spoolsv.exe
748	spoolsv.exe
748	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1728	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	26
PID 844 wrote to memory of 1728	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	26
PID 844 wrote to memory of 1728	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	26
PID 844 wrote to memory of 1728	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	26
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 844 wrote to memory of 1956	844	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	28
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 580	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	32
PID 1956 wrote to memory of 772	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	33
PID 1956 wrote to memory of 772	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	33
PID 1956 wrote to memory of 772	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	33
PID 1956 wrote to memory of 772	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	33
PID 1956 wrote to memory of 772	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	33
PID 1956 wrote to memory of 772	1956	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	33
PID 580 wrote to memory of 564	580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	34
PID 580 wrote to memory of 564	580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	34
PID 580 wrote to memory of 564	580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	34
PID 580 wrote to memory of 564	580	10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe	34
PID 564 wrote to memory of 1500	564	explorer.exe	35
PID 564 wrote to memory of 1500	564	explorer.exe	35
PID 564 wrote to memory of 1500	564	explorer.exe	35
PID 564 wrote to memory of 1500	564	explorer.exe	35
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37
PID 564 wrote to memory of 924	564	explorer.exe	37

C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
"C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
  C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
    C:\Users\Admin\AppData\Local\Temp\10784bdb86533a47ecdc29e5bec5dbe00d9ec02e548b07fc26f10690299b27d6.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:580
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        
        PID:1500
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:924
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:512
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1532
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1908
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1028
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:328
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1960
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1444
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:564
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:960
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1972
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:888
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1580
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1492
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1964
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1468
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-84-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/512-122-0x0000000002C20000-0x0000000002C31000-memory.dmp

Download

memory/512-76-0x0000000002C20000-0x0000000002C31000-memory.dmp

Download

memory/512-124-0x0000000003030000-0x0000000003041000-memory.dmp

Download

memory/512-60-0x0000000002C20000-0x0000000002C31000-memory.dmp

Download

memory/512-59-0x0000000003030000-0x0000000003041000-memory.dmp

Download

memory/512-91-0x0000000002C20000-0x0000000002C31000-memory.dmp

Download

memory/512-57-0x0000000002C20000-0x0000000002C31000-memory.dmp

Download

memory/512-134-0x0000000002C20000-0x0000000002C31000-memory.dmp

Download

memory/512-93-0x0000000003030000-0x0000000003041000-memory.dmp

Download

memory/512-61-0x0000000003030000-0x0000000003041000-memory.dmp

Download

memory/512-135-0x0000000003030000-0x0000000003041000-memory.dmp

Download

memory/512-106-0x0000000002C20000-0x0000000002C31000-memory.dmp

Download

memory/512-77-0x0000000003030000-0x0000000003041000-memory.dmp

Download

memory/512-108-0x0000000003030000-0x0000000003041000-memory.dmp

Download

memory/580-31-0x0000000002720000-0x0000000002724000-memory.dmp

Download

memory/580-16-0x0000000003130000-0x0000000003141000-memory.dmp

Download

memory/580-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/580-18-0x0000000002D20000-0x0000000002D31000-memory.dmp

Download

memory/580-15-0x0000000002D20000-0x0000000002D31000-memory.dmp

Download

memory/580-30-0x0000000000240000-0x0000000000244000-memory.dmp

Download

memory/580-11-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/772-10-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/772-8-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/924-32-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1908-71-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1956-5-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1956-4-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1956-1-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download