Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27-10-2024 19:56
Behavioral task
behavioral1
Sample
0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe
Resource
win10v2004-20241007-en
General
-
Target
0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe
-
Size
8.2MB
-
MD5
97b7a0352464b16ebf2241e7eb8c08a4
-
SHA1
c9b22e8d3f02f481600fa3ec6a652bbfde5eb2c5
-
SHA256
0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be
-
SHA512
76548bb04e9439bdf4d76c9ccc3880c1ef888de50dcacf2b70d5855045d70f22a7a095f8dde541cac67977ddde2de12bd0d8ebafc69385ffe18886f6d976603b
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecR:V8e8e8f8e8e8Q
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0009000000015f4f-39.dat warzonerat behavioral1/files/0x0008000000015e8f-74.dat warzonerat behavioral1/files/0x0008000000015fdb-95.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
resource yara_rule behavioral1/files/0x0009000000015f4f-39.dat aspack_v212_v242 behavioral1/files/0x0008000000015e8f-74.dat aspack_v212_v242 behavioral1/files/0x0008000000015fdb-95.dat aspack_v212_v242 -
Executes dropped EXE 13 IoCs
pid Process 2256 explorer.exe 1724 explorer.exe 1696 spoolsv.exe 2240 spoolsv.exe 1984 spoolsv.exe 2076 spoolsv.exe 2016 spoolsv.exe 2352 spoolsv.exe 2820 spoolsv.exe 2896 spoolsv.exe 2632 spoolsv.exe 2652 spoolsv.exe 2680 svchost.exe -
Loads dropped DLL 64 IoCs
pid Process 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 1724 explorer.exe 1724 explorer.exe 1480 WerFault.exe 1480 WerFault.exe 1480 WerFault.exe 1480 WerFault.exe 1480 WerFault.exe 1480 WerFault.exe 1480 WerFault.exe 1724 explorer.exe 1724 explorer.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1724 explorer.exe 1724 explorer.exe 916 WerFault.exe 916 WerFault.exe 916 WerFault.exe 916 WerFault.exe 916 WerFault.exe 916 WerFault.exe 916 WerFault.exe 1724 explorer.exe 1724 explorer.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 1724 explorer.exe 1724 explorer.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 1724 explorer.exe 1724 explorer.exe 1012 WerFault.exe 1012 WerFault.exe 1012 WerFault.exe 1012 WerFault.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2752 set thread context of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 set thread context of 2276 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 32 PID 2256 set thread context of 1724 2256 explorer.exe 34 PID 2256 set thread context of 2088 2256 explorer.exe 35 PID 1696 set thread context of 2652 1696 spoolsv.exe 53 PID 1696 set thread context of 484 1696 spoolsv.exe 54 -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2412 2240 WerFault.exe 37 1480 1984 WerFault.exe 39 1712 2076 WerFault.exe 41 916 2016 WerFault.exe 43 3048 2352 WerFault.exe 45 3028 2820 WerFault.exe 47 1012 2896 WerFault.exe 49 816 2632 WerFault.exe 51 -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1724 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 1724 explorer.exe 2652 spoolsv.exe 2652 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2672 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 31 PID 2752 wrote to memory of 2276 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 32 PID 2752 wrote to memory of 2276 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 32 PID 2752 wrote to memory of 2276 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 32 PID 2752 wrote to memory of 2276 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 32 PID 2752 wrote to memory of 2276 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 32 PID 2752 wrote to memory of 2276 2752 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 32 PID 2672 wrote to memory of 2256 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 33 PID 2672 wrote to memory of 2256 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 33 PID 2672 wrote to memory of 2256 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 33 PID 2672 wrote to memory of 2256 2672 0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe 33 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 1724 2256 explorer.exe 34 PID 2256 wrote to memory of 2088 2256 explorer.exe 35 PID 2256 wrote to memory of 2088 2256 explorer.exe 35 PID 2256 wrote to memory of 2088 2256 explorer.exe 35 PID 2256 wrote to memory of 2088 2256 explorer.exe 35 PID 2256 wrote to memory of 2088 2256 explorer.exe 35 PID 2256 wrote to memory of 2088 2256 explorer.exe 35 PID 1724 wrote to memory of 1696 1724 explorer.exe 36 PID 1724 wrote to memory of 1696 1724 explorer.exe 36 PID 1724 wrote to memory of 1696 1724 explorer.exe 36 PID 1724 wrote to memory of 1696 1724 explorer.exe 36 PID 1724 wrote to memory of 2240 1724 explorer.exe 37 PID 1724 wrote to memory of 2240 1724 explorer.exe 37 PID 1724 wrote to memory of 2240 1724 explorer.exe 37 PID 1724 wrote to memory of 2240 1724 explorer.exe 37 PID 2240 wrote to memory of 2412 2240 spoolsv.exe 38 PID 2240 wrote to memory of 2412 2240 spoolsv.exe 38 PID 2240 wrote to memory of 2412 2240 spoolsv.exe 38 PID 2240 wrote to memory of 2412 2240 spoolsv.exe 38 PID 1724 wrote to memory of 1984 1724 explorer.exe 39 PID 1724 wrote to memory of 1984 1724 explorer.exe 39 PID 1724 wrote to memory of 1984 1724 explorer.exe 39 PID 1724 wrote to memory of 1984 1724 explorer.exe 39 PID 1984 wrote to memory of 1480 1984 spoolsv.exe 40 PID 1984 wrote to memory of 1480 1984 spoolsv.exe 40 PID 1984 wrote to memory of 1480 1984 spoolsv.exe 40 PID 1984 wrote to memory of 1480 1984 spoolsv.exe 40 PID 1724 wrote to memory of 2076 1724 explorer.exe 41 PID 1724 wrote to memory of 2076 1724 explorer.exe 41 PID 1724 wrote to memory of 2076 1724 explorer.exe 41 PID 1724 wrote to memory of 2076 1724 explorer.exe 41 PID 2076 wrote to memory of 1712 2076 spoolsv.exe 42 PID 2076 wrote to memory of 1712 2076 spoolsv.exe 42 PID 2076 wrote to memory of 1712 2076 spoolsv.exe 42 PID 2076 wrote to memory of 1712 2076 spoolsv.exe 42 PID 1724 wrote to memory of 2016 1724 explorer.exe 43 PID 1724 wrote to memory of 2016 1724 explorer.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe"C:\Users\Admin\AppData\Local\Temp\0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe"C:\Users\Admin\AppData\Local\Temp\0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2652 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:484
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2412
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1480
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1712
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 366⤵
- Loads dropped DLL
- Program crash
PID:916
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 366⤵
- Loads dropped DLL
- Program crash
PID:3048
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 366⤵
- Loads dropped DLL
- Program crash
PID:3028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 366⤵
- Program crash
PID:816
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵PID:2088
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD597b7a0352464b16ebf2241e7eb8c08a4
SHA1c9b22e8d3f02f481600fa3ec6a652bbfde5eb2c5
SHA2560f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be
SHA51276548bb04e9439bdf4d76c9ccc3880c1ef888de50dcacf2b70d5855045d70f22a7a095f8dde541cac67977ddde2de12bd0d8ebafc69385ffe18886f6d976603b
-
Filesize
8.2MB
MD5fc95da5b3a379d29ae64b157873cea89
SHA10edcebcbfee217471c7fd1ef73d9eb4ce8a2f3d3
SHA25664748f6e3284d0c6b94c7ba939b2656081a1e5fa9fe5abdbf4e87a0df36413be
SHA5123d910a75a736c829f2165d8ee6d378854fd37c3f5157b2de8160bffbcdaac3dbe16b3b91a4e0347728c36b501ccae797d1ae234a3ac1dc4f99111cebfbaadead
-
Filesize
8.2MB
MD544c8cc577b4d2be4f8bee990db884c27
SHA11d4212954da89f5595b044b47cb88e9445ca204b
SHA25697e5250c3d51755f257a33e53d3f5a4f1606df01e3cbcc3d36fd7408b9468d04
SHA512b26289511603504d300b53c33ef9ff87795f5f25da668d06278928791b5826a752045b8acde23172e14c26a1d1a5c26d56e292f45e5b7b42a720b5cbf5a2556f