warzonerat | 3e47b5df6434b6115b80b087e782f9d0117e06fffdac2d9fc093f9b8b3614e31

Analysis

max time kernel
118s
max time network
29s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5558a8614292ac1a9280d8e77aee87c0N.exe
Size

2.9MB
MD5

5558a8614292ac1a9280d8e77aee87c0
SHA1

8af08ac2e231394eefe907c387bee84f67408b14
SHA256

3e47b5df6434b6115b80b087e782f9d0117e06fffdac2d9fc093f9b8b3614e31
SHA512

8516145b5293cfe9323bd0193a0c539a732eb63dedbb3516f6e0a4f8d6511586c90974ced3da7a0e3b9537598d290a6ae7258075a9f6aaa1023f85860c524bf8
SSDEEP

24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHu:7v97AXmw4gxeOw46fUbNecCCFbNecx

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/files/0x0007000000018b4d-88.dat	warzonerat
behavioral1/files/0x00060000000186bb-165.dat	warzonerat
behavioral1/files/0x0007000000018b54-182.dat	warzonerat
behavioral1/files/0x0007000000018b54-488.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 16 IoCs

pid	Process
776	explorer.exe
2928	explorer.exe
2976	explorer.exe
1348	spoolsv.exe
1788	spoolsv.exe
2200	spoolsv.exe
1716	spoolsv.exe
2660	spoolsv.exe
2872	spoolsv.exe
1824	spoolsv.exe
2372	spoolsv.exe
892	spoolsv.exe
2532	spoolsv.exe
2236	spoolsv.exe
2100	spoolsv.exe
824	spoolsv.exe

Loads dropped DLL 22 IoCs

pid	Process
1484	5558a8614292ac1a9280d8e77aee87c0N.exe
1484	5558a8614292ac1a9280d8e77aee87c0N.exe
2976	explorer.exe
2976	explorer.exe
1348	spoolsv.exe
2976	explorer.exe
2976	explorer.exe
2200	spoolsv.exe
2976	explorer.exe
2976	explorer.exe
2660	spoolsv.exe
2976	explorer.exe
2976	explorer.exe
1824	spoolsv.exe
2976	explorer.exe
2976	explorer.exe
892	spoolsv.exe
2976	explorer.exe
2976	explorer.exe
2236	spoolsv.exe
2976	explorer.exe
2976	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	5558a8614292ac1a9280d8e77aee87c0N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2164 set thread context of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 set thread context of 2420	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	33
PID 776 set thread context of 2928	776	explorer.exe	37
PID 2928 set thread context of 2976	2928	explorer.exe	38
PID 2928 set thread context of 1084	2928	explorer.exe	39
PID 1348 set thread context of 1788	1348	spoolsv.exe	43
PID 2200 set thread context of 1716	2200	spoolsv.exe	46
PID 2660 set thread context of 2872	2660	spoolsv.exe	50
PID 1824 set thread context of 2372	1824	spoolsv.exe	53
PID 892 set thread context of 2532	892	spoolsv.exe	57
PID 2236 set thread context of 2100	2236	spoolsv.exe	60

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	5558a8614292ac1a9280d8e77aee87c0N.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5558a8614292ac1a9280d8e77aee87c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5558a8614292ac1a9280d8e77aee87c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5558a8614292ac1a9280d8e77aee87c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2300	5558a8614292ac1a9280d8e77aee87c0N.exe
1484	5558a8614292ac1a9280d8e77aee87c0N.exe
776	explorer.exe
1348	spoolsv.exe
2976	explorer.exe
2976	explorer.exe
2200	spoolsv.exe
2976	explorer.exe
2660	spoolsv.exe
2976	explorer.exe
1824	spoolsv.exe
2976	explorer.exe
892	spoolsv.exe
2976	explorer.exe
2236	spoolsv.exe
2976	explorer.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
2300	5558a8614292ac1a9280d8e77aee87c0N.exe
2300	5558a8614292ac1a9280d8e77aee87c0N.exe
1484	5558a8614292ac1a9280d8e77aee87c0N.exe
1484	5558a8614292ac1a9280d8e77aee87c0N.exe
776	explorer.exe
776	explorer.exe
2976	explorer.exe
2976	explorer.exe
1348	spoolsv.exe
1348	spoolsv.exe
2976	explorer.exe
2976	explorer.exe
2200	spoolsv.exe
2200	spoolsv.exe
2660	spoolsv.exe
2660	spoolsv.exe
1824	spoolsv.exe
1824	spoolsv.exe
892	spoolsv.exe
892	spoolsv.exe
2236	spoolsv.exe
2236	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2348	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	29
PID 2300 wrote to memory of 2348	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	29
PID 2300 wrote to memory of 2348	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	29
PID 2300 wrote to memory of 2348	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	29
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2300 wrote to memory of 2164	2300	5558a8614292ac1a9280d8e77aee87c0N.exe	31
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 1484	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	32
PID 2164 wrote to memory of 2420	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	33
PID 2164 wrote to memory of 2420	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	33
PID 2164 wrote to memory of 2420	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	33
PID 2164 wrote to memory of 2420	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	33
PID 2164 wrote to memory of 2420	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	33
PID 2164 wrote to memory of 2420	2164	5558a8614292ac1a9280d8e77aee87c0N.exe	33
PID 1484 wrote to memory of 776	1484	5558a8614292ac1a9280d8e77aee87c0N.exe	34
PID 1484 wrote to memory of 776	1484	5558a8614292ac1a9280d8e77aee87c0N.exe	34
PID 1484 wrote to memory of 776	1484	5558a8614292ac1a9280d8e77aee87c0N.exe	34
PID 1484 wrote to memory of 776	1484	5558a8614292ac1a9280d8e77aee87c0N.exe	34
PID 776 wrote to memory of 2552	776	explorer.exe	35
PID 776 wrote to memory of 2552	776	explorer.exe	35
PID 776 wrote to memory of 2552	776	explorer.exe	35
PID 776 wrote to memory of 2552	776	explorer.exe	35
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37
PID 776 wrote to memory of 2928	776	explorer.exe	37

C:\Users\Admin\AppData\Local\Temp\5558a8614292ac1a9280d8e77aee87c0N.exe
"C:\Users\Admin\AppData\Local\Temp\5558a8614292ac1a9280d8e77aee87c0N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\5558a8614292ac1a9280d8e77aee87c0N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\5558a8614292ac1a9280d8e77aee87c0N.exe
  C:\Users\Admin\AppData\Local\Temp\5558a8614292ac1a9280d8e77aee87c0N.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\5558a8614292ac1a9280d8e77aee87c0N.exe
    C:\Users\Admin\AppData\Local\Temp\5558a8614292ac1a9280d8e77aee87c0N.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2552
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2928
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2092
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2860
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1632
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1328
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:3008
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1840
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1956
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1084
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
5558a8614292ac1a9280d8e77aee87c0

SHA1
8af08ac2e231394eefe907c387bee84f67408b14

SHA256
3e47b5df6434b6115b80b087e782f9d0117e06fffdac2d9fc093f9b8b3614e31

SHA512
8516145b5293cfe9323bd0193a0c539a732eb63dedbb3516f6e0a4f8d6511586c90974ced3da7a0e3b9537598d290a6ae7258075a9f6aaa1023f85860c524bf8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Windows\system\explorer.exe

Filesize
2.9MB

MD5
379bff83561af3a7e4247760e9a9d802

SHA1
748ae473e6eed370fae3056c824823d94cca04ff

SHA256
536143fc73faef3808ef8a63c4332e69aeabf93733ae80cd67b8ed59e6a1a154

SHA512
6659b8afcc94777435f10e2b3d90e09818c737577d4fb18ba8c6491f473729bb159e406485e378e7e2cabc4903d2a9e3359b5467b5360b0dd0c5c1abc0e2f2f3

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
2.3MB

MD5
cce4f43d3a7a4a66297e4684fed2c57b

SHA1
4eba6f65c3a55df2d5894c75e8e99726bba0accf

SHA256
e12241b12f6f5198c5334f40af2a700aa665372a6eca7e91d617ea06f2971f56

SHA512
b6dac68a4c2d7a25e4bda8e05dff9741f3a28214b179616ffad58b9b43d68aeb4bd8e403a4c2dd34a2f9a08198248ddd8f24ebec2a6a14d1ab77033e36d4a4d4

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
f32c2f50c35eb516d496a894b9ded01e

SHA1
e7683eed10280e42db5efbcad2c5f4b7e3f4184d

SHA256
0eb7e05d7226c588aeab284f2a0033a8f320953d5643414f13940286c2ab1e7c

SHA512
5f4a421a008f5667942bff106fe89860c869142dd49eef2fd31f8d9c77e321ee8778cc2d38e723536ce2bd819c5ddf4216df088029ba496ff27cf82c88df829b

Download Submit
\Windows\system\spoolsv.exe

Filesize
1.1MB

MD5
3aa0b47b71831e7fc39c3cd8cdd0f794

SHA1
e23a1904ca0b4c377e5295ab2df1f48ab7a8c163

SHA256
70146758bf952e8f5fb7e2d06025528dcc7da9682632854a790855ad6a2461b6

SHA512
42f768d0de0c90b600f575ba6174ac6c3fce084d6b8703fed3f171b662ea8774300ea89af02f9d985cb91739b5ce01c9f4299e10a762b2a351cf0a3e2df2b642

Download Submit
memory/1484-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1484-146-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1484-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1484-83-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1484-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1484-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1716-287-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1788-254-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2100-498-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2164-23-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-82-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2164-41-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-49-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2164-43-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2164-21-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-46-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-40-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2164-7-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-42-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2164-35-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2164-29-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-51-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2164-50-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2164-48-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-44-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2164-47-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2164-20-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-45-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2164-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-5-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-9-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-16-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-25-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-18-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-14-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-28-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-32-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-38-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2164-12-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2420-81-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2420-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2532-479-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2872-341-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2928-176-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2928-147-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download