warzonerat | ba745618c6b51b90d9a764f1eedaf67ee674ed6723715b7510829dac25c3eb67

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
Size

1.2MB
MD5

a6d2a1498c88e7d4ea9ceac12e06d87d
SHA1

1e598c2f98a7566ad13dfdcd0b9e72daf71acfb2
SHA256

ba745618c6b51b90d9a764f1eedaf67ee674ed6723715b7510829dac25c3eb67
SHA512

685b2a43cf9b06aebfcd934b4944e052ff27774d417d86018d4fac91a7d795e7610d5bc6596d99811b8c9d1dda22d2288905b4ef257b3756576197f1faf89a77
SSDEEP

12288:GIbsBDU0I6+Tu0TJ0N1oYgeOF5A7W2FeDSIGVH/KIDgDgUeHbY1tkX:GIbGD2JTu0GoWQDbGV6eH8tkX

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/files/0x0009000000016635-42.dat	warzonerat
behavioral1/files/0x000800000001631e-78.dat	warzonerat
behavioral1/files/0x0008000000016ab4-93.dat	warzonerat
behavioral1/files/0x0007000000017406-229.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0009000000016635-42.dat	aspack_v212_v242
behavioral1/files/0x000800000001631e-78.dat	aspack_v212_v242
behavioral1/files/0x0008000000016ab4-93.dat	aspack_v212_v242
behavioral1/files/0x0007000000017406-229.dat	aspack_v212_v242

Executes dropped EXE 10 IoCs

pid	Process
2640	explorer.exe
2584	explorer.exe
1680	spoolsv.exe
2120	spoolsv.exe
1340	spoolsv.exe
1764	spoolsv.exe
292	spoolsv.exe
884	spoolsv.exe
2092	spoolsv.exe
2876	svchost.exe

Loads dropped DLL 52 IoCs

pid	Process
2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2208	WerFault.exe
2208	WerFault.exe
2208	WerFault.exe
2208	WerFault.exe
2208	WerFault.exe
2208	WerFault.exe
2208	WerFault.exe
2584	explorer.exe
2584	explorer.exe
2468	WerFault.exe
2468	WerFault.exe
2468	WerFault.exe
2468	WerFault.exe
2468	WerFault.exe
2468	WerFault.exe
2468	WerFault.exe
2584	explorer.exe
2584	explorer.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
2584	explorer.exe
2584	explorer.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2584	explorer.exe
2584	explorer.exe
2248	WerFault.exe
2248	WerFault.exe
2248	WerFault.exe
2248	WerFault.exe
2248	WerFault.exe
2248	WerFault.exe
1680	spoolsv.exe
2248	WerFault.exe
2092	spoolsv.exe
2092	spoolsv.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 set thread context of 2852	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	32
PID 2640 set thread context of 2584	2640	explorer.exe	34
PID 2640 set thread context of 2376	2640	explorer.exe	35
PID 1680 set thread context of 2092	1680	spoolsv.exe	47
PID 1680 set thread context of 2008	1680	spoolsv.exe	48

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2208	2120	WerFault.exe	37
2468	1340	WerFault.exe	39
896	1764	WerFault.exe	41
2000	292	WerFault.exe	43
2248	884	WerFault.exe	45

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2584	explorer.exe
2092	spoolsv.exe
2092	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2720	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	31
PID 1856 wrote to memory of 2852	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	32
PID 1856 wrote to memory of 2852	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	32
PID 1856 wrote to memory of 2852	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	32
PID 1856 wrote to memory of 2852	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	32
PID 1856 wrote to memory of 2852	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	32
PID 1856 wrote to memory of 2852	1856	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	32
PID 2720 wrote to memory of 2640	2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	33
PID 2720 wrote to memory of 2640	2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	33
PID 2720 wrote to memory of 2640	2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	33
PID 2720 wrote to memory of 2640	2720	a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe	33
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2584	2640	explorer.exe	34
PID 2640 wrote to memory of 2376	2640	explorer.exe	35
PID 2640 wrote to memory of 2376	2640	explorer.exe	35
PID 2640 wrote to memory of 2376	2640	explorer.exe	35
PID 2640 wrote to memory of 2376	2640	explorer.exe	35
PID 2640 wrote to memory of 2376	2640	explorer.exe	35
PID 2640 wrote to memory of 2376	2640	explorer.exe	35
PID 2584 wrote to memory of 1680	2584	explorer.exe	36
PID 2584 wrote to memory of 1680	2584	explorer.exe	36
PID 2584 wrote to memory of 1680	2584	explorer.exe	36
PID 2584 wrote to memory of 1680	2584	explorer.exe	36
PID 2584 wrote to memory of 2120	2584	explorer.exe	37
PID 2584 wrote to memory of 2120	2584	explorer.exe	37
PID 2584 wrote to memory of 2120	2584	explorer.exe	37
PID 2584 wrote to memory of 2120	2584	explorer.exe	37
PID 2120 wrote to memory of 2208	2120	spoolsv.exe	38
PID 2120 wrote to memory of 2208	2120	spoolsv.exe	38
PID 2120 wrote to memory of 2208	2120	spoolsv.exe	38
PID 2120 wrote to memory of 2208	2120	spoolsv.exe	38
PID 2584 wrote to memory of 1340	2584	explorer.exe	39
PID 2584 wrote to memory of 1340	2584	explorer.exe	39
PID 2584 wrote to memory of 1340	2584	explorer.exe	39
PID 2584 wrote to memory of 1340	2584	explorer.exe	39
PID 1340 wrote to memory of 2468	1340	spoolsv.exe	40
PID 1340 wrote to memory of 2468	1340	spoolsv.exe	40
PID 1340 wrote to memory of 2468	1340	spoolsv.exe	40
PID 1340 wrote to memory of 2468	1340	spoolsv.exe	40
PID 2584 wrote to memory of 1764	2584	explorer.exe	41
PID 2584 wrote to memory of 1764	2584	explorer.exe	41
PID 2584 wrote to memory of 1764	2584	explorer.exe	41
PID 2584 wrote to memory of 1764	2584	explorer.exe	41
PID 1764 wrote to memory of 896	1764	spoolsv.exe	42
PID 1764 wrote to memory of 896	1764	spoolsv.exe	42
PID 1764 wrote to memory of 896	1764	spoolsv.exe	42
PID 1764 wrote to memory of 896	1764	spoolsv.exe	42
PID 2584 wrote to memory of 292	2584	explorer.exe	43
PID 2584 wrote to memory of 292	2584	explorer.exe	43

C:\Users\Admin\AppData\Local\Temp\a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a6d2a1498c88e7d4ea9ceac12e06d87d_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1680
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2876
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:292
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2248
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:2376
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
1.2MB

MD5
a6d2a1498c88e7d4ea9ceac12e06d87d

SHA1
1e598c2f98a7566ad13dfdcd0b9e72daf71acfb2

SHA256
ba745618c6b51b90d9a764f1eedaf67ee674ed6723715b7510829dac25c3eb67

SHA512
685b2a43cf9b06aebfcd934b4944e052ff27774d417d86018d4fac91a7d795e7610d5bc6596d99811b8c9d1dda22d2288905b4ef257b3756576197f1faf89a77

Download Submit
C:\Windows\system\explorer.exe

Filesize
1.2MB

MD5
e59f9314a28d345403e2e02193608b8a

SHA1
6bcd56683e34b3fa0b9ece37d3690f78702c5a8a

SHA256
f60f957b485f7c0992d214f9db2b19b72fd51bf7a32ef5e7372d108f3413b424

SHA512
12c042d91681d6ffab9e0f5684fd2bf996775d67c70b1ac1997df591caf57be7eaf9e660797847f74a09baf8cfece83d7ab567d929e9c29bdd5ef5a09d762fd4

Download Submit
\Windows\system\spoolsv.exe

Filesize
1.2MB

MD5
a3fc360f32f7608cb4bb90357e545f07

SHA1
ad472a740c15b4d05f7a855442ed20987c524804

SHA256
9125033834f58e3b6c0b23f12fd64a66bdae4361a8db5119dbcd3672894c078c

SHA512
db4b32a08198ee15703d60aa5fb2cbc16619a19151bfdf0045bc3e6044d0cc4ec4add6c72e2d1a4cd4a50b120553c14a9187fa154a73c878e7b6dd78631514e9

Download Submit
\Windows\system\svchost.exe

Filesize
1.2MB

MD5
ca6e4f07e963e030136237f027cff6da

SHA1
a3762886c9f6b901bb10fc460f8f1bf5de4a52a7

SHA256
31785b1c15eeaa7c9933caeaa422896127c77217175ea1c0c66ecfe891bd33fd

SHA512
e1902217b5a779cd9f38b8c0b84028c14e3c515a40475a0bdeb4703e648f36b9464c00ae5abdc8977cec5ba40eda3e9b0b95ccf4382f0513fea9a1dc5aa87dfe

Download Submit
memory/1340-139-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1680-101-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1680-225-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1680-125-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1680-103-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1680-104-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1856-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1856-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1856-24-0x00000000031F0000-0x0000000003304000-memory.dmp

Filesize
1.1MB

Download
memory/1856-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1856-39-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1856-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1856-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1856-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2092-235-0x00000000032C0000-0x00000000033D4000-memory.dmp

Filesize
1.1MB

Download
memory/2092-234-0x00000000032C0000-0x00000000033D4000-memory.dmp

Filesize
1.1MB

Download
memory/2092-239-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-115-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2120-129-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2584-137-0x00000000030C0000-0x00000000031D4000-memory.dmp

Filesize
1.1MB

Download
memory/2584-123-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2584-124-0x00000000030C0000-0x00000000031D4000-memory.dmp

Filesize
1.1MB

Download
memory/2584-126-0x00000000030C0000-0x00000000031D4000-memory.dmp

Filesize
1.1MB

Download
memory/2584-102-0x00000000030C0000-0x00000000031D4000-memory.dmp

Filesize
1.1MB

Download
memory/2584-147-0x00000000030C0000-0x00000000031D4000-memory.dmp

Filesize
1.1MB

Download
memory/2584-148-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2584-149-0x00000000030C0000-0x00000000031D4000-memory.dmp

Filesize
1.1MB

Download
memory/2584-244-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2640-58-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2640-52-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2640-87-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2640-51-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2640-54-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2640-53-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2720-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2720-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2720-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2720-55-0x0000000000440000-0x000000000051F000-memory.dmp

Filesize
892KB

Download
memory/2720-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2720-18-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2720-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2720-49-0x0000000003420000-0x0000000003534000-memory.dmp

Filesize
1.1MB

Download
memory/2852-28-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2852-36-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2852-38-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2852-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-32-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2876-241-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download