warzonerat | de9bc3a4498c44e9dd876a38ec704dbd9c8a0830abd6d1be8a18a9593d913066

Analysis

max time kernel
90s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05/04/2022, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vbc.exe
Size 1.1MB
Sample220405-natwkshcak
SHA256 de9bc3a4498c44e9dd876a38ec704dbd9c8a0830abd6d1be8a18a9593d913066
MD5 0944744c31d37852031093e490a79450
SHA1 581e4f1d292dc84bce3d2b03c1b675afd716b374
SHA512 2852f827d2af02ad05f41c8ea3fb249cfe6e1059a646b53a2d8ae7c8c6e192655b277f0ddaa60f15a50d73b97d2fe4d3bf61588f7f6c81ea8959d8fe1c9927ca
MD5 SHA1 SHA512

Score

10^/10

warzonerat discovery evasion infostealer rat

Malware Config

Extracted

Family

warzonerat

guiller.ddns.net:7890

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Warzone RAT Payload 6 IoCs

rat

resource	yara_rule
behavioral2/memory/4388-136-0x0000000000400000-0x0000000000555000-memory.dmp	warzonerat
behavioral2/memory/4388-138-0x0000000000400000-0x0000000000555000-memory.dmp	warzonerat
behavioral2/memory/2564-143-0x0000000000400000-0x0000000000555000-memory.dmp	warzonerat
behavioral2/memory/4640-147-0x0000000000400000-0x0000000000555000-memory.dmp	warzonerat
behavioral2/memory/1500-151-0x0000000000400000-0x0000000000555000-memory.dmp	warzonerat
behavioral2/memory/4140-199-0x0000000000400000-0x0000000000555000-memory.dmp	warzonerat

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	vbc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4800	takeown.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	vbc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	vbc.exe

Suspicious use of SetThreadContext 23 IoCs

description	pid	Process	procid_target
PID 1012 set thread context of 4388	1012	vbc.exe	80
PID 1012 set thread context of 2564	1012	vbc.exe	88
PID 1012 set thread context of 4640	1012	vbc.exe	92
PID 1012 set thread context of 1500	1012	vbc.exe	97
PID 1012 set thread context of 4416	1012	vbc.exe	100
PID 1012 set thread context of 2800	1012	vbc.exe	103
PID 1012 set thread context of 3580	1012	vbc.exe	106
PID 1012 set thread context of 1688	1012	vbc.exe	111
PID 1012 set thread context of 3636	1012	vbc.exe	114
PID 1012 set thread context of 440	1012	vbc.exe	118
PID 1012 set thread context of 932	1012	vbc.exe	121
PID 1012 set thread context of 4488	1012	vbc.exe	125
PID 1012 set thread context of 4012	1012	vbc.exe	129
PID 1012 set thread context of 804	1012	vbc.exe	132
PID 1012 set thread context of 4140	1012	vbc.exe	137
PID 1012 set thread context of 1044	1012	vbc.exe	141
PID 1012 set thread context of 4688	1012	vbc.exe	144
PID 1012 set thread context of 4624	1012	vbc.exe	147
PID 1012 set thread context of 1304	1012	vbc.exe	151
PID 1012 set thread context of 1732	1012	vbc.exe	154
PID 1012 set thread context of 1512	1012	vbc.exe	157
PID 1012 set thread context of 4592	1012	vbc.exe	160
PID 1012 set thread context of 2756	1012	vbc.exe	165

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Program crash 23 IoCs

pid	pid_target	Process	procid_target
1396	4388	WerFault.exe	80
5016	2564	WerFault.exe	88
4700	4640	WerFault.exe	92
1244	1500	WerFault.exe	97
4784	4416	WerFault.exe	100
4044	2800	WerFault.exe	103
5060	3580	WerFault.exe	106
212	1688	WerFault.exe	111
1832	3636	WerFault.exe	114
5024	440	WerFault.exe	118
3824	932	WerFault.exe	121
2380	4488	WerFault.exe	125
3496	4012	WerFault.exe	129
2592	804	WerFault.exe	132
4128	4140	WerFault.exe	137
4572	1044	WerFault.exe	141
4704	4688	WerFault.exe	144
1424	4624	WerFault.exe	147
408	1304	WerFault.exe	151
1080	1732	WerFault.exe	154
1984	1512	WerFault.exe	157
3908	4592	WerFault.exe	160
752	2756	WerFault.exe	165

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4592	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe
1012	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1012	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 4388	1012	vbc.exe	80
PID 1012 wrote to memory of 2420	1012	vbc.exe	87
PID 1012 wrote to memory of 2420	1012	vbc.exe	87
PID 1012 wrote to memory of 2420	1012	vbc.exe	87
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 2564	1012	vbc.exe	88
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 4640	1012	vbc.exe	92
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 1500	1012	vbc.exe	97
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 4416	1012	vbc.exe	100
PID 1012 wrote to memory of 2800	1012	vbc.exe	103
PID 1012 wrote to memory of 2800	1012	vbc.exe	103
PID 1012 wrote to memory of 2800	1012	vbc.exe	103
PID 1012 wrote to memory of 2800	1012	vbc.exe	103
PID 1012 wrote to memory of 2800	1012	vbc.exe	103
PID 1012 wrote to memory of 2800	1012	vbc.exe	103

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\SysWOW64\fontdrvhost.exe"
  2⤵
  PID:4388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 524
    3⤵
    - Program crash
    PID:1396
- C:\Windows\SysWOW64\GamePanel.exe
  "C:\Windows\SysWOW64\GamePanel.exe"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\WPDShextAutoplay.exe
  "C:\Windows\SysWOW64\WPDShextAutoplay.exe"
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 524
    3⤵
    - Program crash
    PID:5016
- C:\Windows\SysWOW64\PkgMgr.exe
  "C:\Windows\SysWOW64\PkgMgr.exe"
  2⤵
  PID:4640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 524
    3⤵
    - Program crash
    PID:4700
- C:\Windows\SysWOW64\ComputerDefaults.exe
  "C:\Windows\SysWOW64\ComputerDefaults.exe"
  2⤵
  PID:1500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 524
    3⤵
    - Program crash
    PID:1244
- C:\Windows\SysWOW64\SearchFilterHost.exe
  "C:\Windows\SysWOW64\SearchFilterHost.exe"
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 544
    3⤵
    - Program crash
    PID:4784
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\SysWOW64\fontdrvhost.exe"
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 544
    3⤵
    - Program crash
    PID:4044
- C:\Windows\SysWOW64\GamePanel.exe
  "C:\Windows\SysWOW64\GamePanel.exe"
  2⤵
  PID:3580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 524
    3⤵
    - Program crash
    PID:5060
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\SysWOW64\sc.exe"
  2⤵
  PID:2244
- C:\Windows\SysWOW64\RdpSaUacHelper.exe
  "C:\Windows\SysWOW64\RdpSaUacHelper.exe"
  2⤵
  PID:3776
- C:\Windows\SysWOW64\InfDefaultInstall.exe
  "C:\Windows\SysWOW64\InfDefaultInstall.exe"
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 544
    3⤵
    - Program crash
    PID:212
- C:\Windows\SysWOW64\where.exe
  "C:\Windows\SysWOW64\where.exe"
  2⤵
  PID:3636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 544
    3⤵
    - Program crash
    PID:1832
- C:\Windows\SysWOW64\OneDriveSetup.exe
  "C:\Windows\SysWOW64\OneDriveSetup.exe"
  2⤵
  PID:440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 548
    3⤵
    - Program crash
    PID:5024
- C:\Windows\SysWOW64\winver.exe
  "C:\Windows\SysWOW64\winver.exe"
  2⤵
  PID:932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 536
    3⤵
    - Program crash
    PID:3824
- C:\Windows\SysWOW64\odbcconf.exe
  "C:\Windows\SysWOW64\odbcconf.exe"
  2⤵
  PID:2528
- C:\Windows\SysWOW64\Utilman.exe
  "C:\Windows\SysWOW64\Utilman.exe"
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 524
    3⤵
    - Program crash
    PID:2380
- C:\Windows\SysWOW64\relog.exe
  "C:\Windows\SysWOW64\relog.exe"
  2⤵
  PID:2296
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\SysWOW64\backgroundTaskHost.exe"
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 536
    3⤵
    - Program crash
    PID:3496
- C:\Windows\SysWOW64\eventvwr.exe
  "C:\Windows\SysWOW64\eventvwr.exe"
  2⤵
  PID:804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 536
    3⤵
    - Program crash
    PID:2592
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\SysWOW64\regsvr32.exe"
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 628
    3⤵
    - Program crash
    PID:4128
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:2016
- C:\Windows\SysWOW64\charmap.exe
  "C:\Windows\SysWOW64\charmap.exe"
  2⤵
  PID:1044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 536
    3⤵
    - Program crash
    PID:4572
- C:\Windows\SysWOW64\forfiles.exe
  "C:\Windows\SysWOW64\forfiles.exe"
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 524
    3⤵
    - Program crash
    PID:4704
- C:\Windows\SysWOW64\BackgroundTransferHost.exe
  "C:\Windows\SysWOW64\BackgroundTransferHost.exe"
  2⤵
  PID:4624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 524
    3⤵
    - Program crash
    PID:1424
- C:\Windows\SysWOW64\ARP.EXE
  "C:\Windows\SysWOW64\ARP.EXE"
  2⤵
  PID:3548
- C:\Windows\SysWOW64\wecutil.exe
  "C:\Windows\SysWOW64\wecutil.exe"
  2⤵
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 524
    3⤵
    - Program crash
    PID:408
- C:\Windows\SysWOW64\fsutil.exe
  "C:\Windows\SysWOW64\fsutil.exe"
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 544
    3⤵
    - Program crash
    PID:1080
- C:\Windows\SysWOW64\dcomcnfg.exe
  "C:\Windows\SysWOW64\dcomcnfg.exe"
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 544
    3⤵
    - Program crash
    PID:1984
- C:\Windows\SysWOW64\PING.EXE
  "C:\Windows\SysWOW64\PING.EXE"
  2⤵
  - Runs ping.exe
  PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 524
    3⤵
    - Program crash
    PID:3908
- C:\Windows\SysWOW64\subst.exe
  "C:\Windows\SysWOW64\subst.exe"
  2⤵
  PID:1912
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\SysWOW64\bitsadmin.exe"
  2⤵
  PID:5060
- C:\Windows\SysWOW64\charmap.exe
  "C:\Windows\SysWOW64\charmap.exe"
  2⤵
  PID:2756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 524
    3⤵
    - Program crash
    PID:752
- C:\Windows\SysWOW64\takeown.exe
  "C:\Windows\SysWOW64\takeown.exe"
  2⤵
  - Modifies file permissions
  PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4388 -ip 4388
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2564 -ip 2564
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4640 -ip 4640
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1500 -ip 1500
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4416 -ip 4416
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2800 -ip 2800
1⤵
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3580 -ip 3580
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1688 -ip 1688
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3636 -ip 3636
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 440 -ip 440
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 932 -ip 932
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4488 -ip 4488
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4012 -ip 4012
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 804 -ip 804
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4140 -ip 4140
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1044 -ip 1044
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4688 -ip 4688
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4624 -ip 4624
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1304 -ip 1304
1⤵
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1732 -ip 1732
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1512 -ip 1512
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4592 -ip 4592
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2756 -ip 2756
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-131-0x0000000005590000-0x0000000005B34000-memory.dmp

Download

memory/1012-132-0x0000000005080000-0x0000000005112000-memory.dmp

Download

memory/1012-133-0x00000000051C0000-0x000000000525C000-memory.dmp

Download

memory/1012-134-0x0000000006CB0000-0x0000000006D16000-memory.dmp

Download

memory/1012-130-0x00000000005B0000-0x00000000006CC000-memory.dmp

Download

memory/1500-151-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/2564-143-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/4140-199-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/4388-138-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/4388-136-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/4640-147-0x0000000000400000-0x0000000000555000-memory.dmp

Download