Overview

overview

10

Static

static

10

e83a4d9dc1...aN.exe

windows7-x64

10

e83a4d9dc1...aN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2024 02:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baaN.exe

  • Size

    6.1MB

  • MD5

    8366095353711474f30ebee85c51a090

  • SHA1

    e8a0aea3dd081528cb9edd6fb454b6ac47177e1c

  • SHA256

    e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baa

  • SHA512

    50ebb10387b8c0ed3a64142c98cc6868320e3388bc4d6ba47addb9baf17203a6c5264053787749c53aaddb7a5ec6948d954555be7197b8f30c06d15a09091ad1

  • SSDEEP

    49152:ATU7AAmw4gxeOw46fUbNecCCFbNecjTU7AAmw4gxeOw46fUbNecCCFbNecq:ATU7d9xZw46G8q8yTU7d9xZw46G8q8t

Score
10/10
warzoneratdiscoveryevasioninfostealerpersistenceratupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzone RAT payload 3 IoCs
    rat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 18 IoCs
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 59 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetThreadContext 24 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of SetWindowsHookEx 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baaN.exe
    "C:\Users\Admin\AppData\Local\Temp\e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baaN.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baaN.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
      2⤵
      • Drops startup file
      • System Location Discovery: System Language Discovery
      PID:2988
    • C:\Users\Admin\AppData\Local\Temp\e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baaN.exe
      C:\Users\Admin\AppData\Local\Temp\e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baaN.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Users\Admin\AppData\Local\Temp\e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baaN.exe
        C:\Users\Admin\AppData\Local\Temp\e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baaN.exe
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2524
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1596
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
            5⤵
            • Drops startup file
            • System Location Discovery: System Language Discovery
            PID:1308
          • \??\c:\windows\system\explorer.exe
            c:\windows\system\explorer.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2384
            • \??\c:\windows\system\explorer.exe
              c:\windows\system\explorer.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visiblity of hidden/system files in Explorer
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:956
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:832
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                  8⤵
                  • Drops startup file
                  • System Location Discovery: System Language Discovery
                  PID:2440
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2540
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:2992
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                  8⤵
                    PID:2860
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1368
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2328
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:2928
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2316
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2164
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:2052
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2016
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2704
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:2324
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1916
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2784
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:1120
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2044
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:1580
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:1748
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1060
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2640
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:480
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2804
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2676
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:532
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2876
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:1660
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:2892
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3016
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2516
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:2116
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2456
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:1656
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:1940
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:688
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2520
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                    • Drops startup file
                    • System Location Discovery: System Language Discovery
                    PID:1804
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2348
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:2832
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                      PID:2328
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:2716
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:1244
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:2008
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3004
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:1592
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                        PID:1892
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe
                        8⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2176
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:2964
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                        8⤵
                        • Drops startup file
                        • System Location Discovery: System Language Discovery
                        PID:1092
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe
                        8⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2452
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:1940
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                        8⤵
                        • Drops startup file
                        • System Location Discovery: System Language Discovery
                        PID:1656
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe
                        8⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:440
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:1576
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                        8⤵
                        • Drops startup file
                        • System Location Discovery: System Language Discovery
                        PID:2156
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe
                        8⤵
                          PID:1788
                    • C:\Windows\SysWOW64\diskperf.exe
                      "C:\Windows\SysWOW64\diskperf.exe"
                      6⤵
                        PID:1076
                • C:\Windows\SysWOW64\diskperf.exe
                  "C:\Windows\SysWOW64\diskperf.exe"
                  3⤵
                    PID:272

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
                Filesize

                6.1MB

                MD5

                8366095353711474f30ebee85c51a090

                SHA1

                e8a0aea3dd081528cb9edd6fb454b6ac47177e1c

                SHA256

                e83a4d9dc17c3b84f8c0b811eb314d055a8f98b5276d120cd3c8190736526baa

                SHA512

                50ebb10387b8c0ed3a64142c98cc6868320e3388bc4d6ba47addb9baf17203a6c5264053787749c53aaddb7a5ec6948d954555be7197b8f30c06d15a09091ad1

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
                Filesize

                92B

                MD5

                13222a4bb413aaa8b92aa5b4f81d2760

                SHA1

                268a48f2fe84ed49bbdc1873a8009db8c7cba66a

                SHA256

                d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

                SHA512

                eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
                Filesize

                93B

                MD5

                8445bfa5a278e2f068300c604a78394b

                SHA1

                9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

                SHA256

                5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

                SHA512

                8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

                Download Submit

              • \??\c:\windows\system\explorer.exe
                Filesize

                6.1MB

                MD5

                768f47405528ce02e9c71a10e192abfe

                SHA1

                8876daf2b372f7a02d0fa2e9efa7abbc34834509

                SHA256

                92e29fbc5548774e5c69662489653fc1f9514ce6f361ddd44fedca19e3479c64

                SHA512

                8b8ad07a37e548cd826cdfb35d90ae7524b56a5bd4c0de2ee2140d8846e2d07d0b30d89cd6307c96f649915a253165db08ba91ec56d2546cebd8334870514af7

                Download Submit

              • \Windows\system\spoolsv.exe
                Filesize

                6.1MB

                MD5

                9f8771dd0e637ee3894766b4e1eb901b

                SHA1

                7c2281705d4d5e82a0b93c34b957e0daf8ede4ab

                SHA256

                4a685df23ff9837c5bf9d527433fde0414fd9bacf0dbb356ad128cc97fac0f50

                SHA512

                f18fe74265e30925c496cd6711535a967091f07540f1d59c1baef402469d4815a57b276ea71ed336c04afc35506a4b5b9b6dcb1e0885c1ab163bc4f91d49df9a

                Download Submit

              • memory/272-72-0x0000000000400000-0x0000000000412000-memory.dmp

                Filesize

                72KB

                Download

              • memory/272-84-0x0000000000400000-0x0000000000412000-memory.dmp

                Filesize

                72KB

                Download

              • memory/688-849-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/832-193-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-588-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-417-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-860-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-903-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-904-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-850-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-851-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-854-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-248-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-360-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-799-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-301-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-801-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-747-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-749-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-302-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-359-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-643-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-644-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-587-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-307-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-357-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-957-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-539-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-956-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-356-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-1054-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-1006-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-530-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-531-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-190-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-473-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-474-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-1055-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-414-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-415-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-416-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-1058-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/956-954-0x0000000003150000-0x0000000003196000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1060-583-0x0000000000400000-0x0000000001990000-memory.dmp

                Filesize

                21.6MB

                Download

              • memory/1244-964-0x0000000001CB0000-0x0000000001CF6000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1244-958-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1368-297-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/1580-532-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1592-1008-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1596-98-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1656-800-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1656-806-0x0000000001D20000-0x0000000001D66000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1660-698-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1660-705-0x0000000000490000-0x00000000004D6000-memory.dmp

                Filesize

                280KB

                Download

              • memory/1916-468-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2016-410-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2044-525-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2164-404-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2176-1056-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2316-353-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2328-303-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2348-905-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2384-141-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2384-181-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2456-797-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2516-748-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2516-768-0x0000000001DB0000-0x0000000001DF6000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2520-862-0x00000000002F0000-0x0000000000336000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2520-853-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2524-149-0x0000000000400000-0x000000000043E000-memory.dmp

                Filesize

                248KB

                Download

              • memory/2524-58-0x0000000000400000-0x000000000043E000-memory.dmp

                Filesize

                248KB

                Download

              • memory/2524-62-0x0000000000400000-0x000000000043E000-memory.dmp

                Filesize

                248KB

                Download

              • memory/2524-56-0x0000000000400000-0x000000000043E000-memory.dmp

                Filesize

                248KB

                Download

              • memory/2524-54-0x0000000000400000-0x000000000043E000-memory.dmp

                Filesize

                248KB

                Download

              • memory/2524-71-0x0000000000400000-0x000000000043E000-memory.dmp

                Filesize

                248KB

                Download

              • memory/2524-94-0x0000000002B70000-0x0000000002BB6000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2524-95-0x0000000002B70000-0x0000000002BB6000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2524-75-0x0000000000400000-0x000000000043E000-memory.dmp

                Filesize

                248KB

                Download

              • memory/2540-237-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2640-589-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2676-652-0x0000000001D80000-0x0000000001DC6000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2676-645-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2704-425-0x0000000000450000-0x0000000000496000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2704-418-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2716-955-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2784-482-0x0000000000270000-0x00000000002B6000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2784-475-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2804-639-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2832-906-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2832-912-0x00000000004D0000-0x0000000000516000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2876-695-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/2936-0-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2936-41-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2964-1059-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2992-249-0x0000000000400000-0x0000000000446000-memory.dmp

                Filesize

                280KB

                Download

              • memory/2992-266-0x0000000000450000-0x0000000000496000-memory.dmp

                Filesize

                280KB

                Download

              • memory/3004-1007-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/3016-745-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/3068-85-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/3068-49-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/3068-17-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-3-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-20-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-26-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-29-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-11-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-8-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-23-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3068-35-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-10-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-48-0x00000000004E7000-0x0000000000513000-memory.dmp

                Filesize

                176KB

                Download

              • memory/3068-43-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/3068-13-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-16-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-21-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-40-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/3068-44-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-42-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-47-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-46-0x0000000000400000-0x0000000000628000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/3068-39-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-32-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-27-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-45-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-6-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3068-2-0x0000000000300000-0x0000000000400000-memory.dmp

                Filesize

                1024KB

                Download