Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
28-10-2024 05:40
Behavioral task
behavioral1
Sample
dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe
Resource
win10v2004-20241007-en
General
-
Target
dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe
-
Size
8.2MB
-
MD5
f3dd3a2b20e6be24171a37f548221c8f
-
SHA1
1b405add2b15b47be75aab4e7d2dc60e487d54b6
-
SHA256
dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76
-
SHA512
04eb816ec4104efd65995f8f4051767fcee142bba12ce6249d7eb01c4bd99b473a4f9ca9615284256354a97fa69e0b1f4631cface91c172abb3f625acff994b2
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecz:V8e8e8f8e8e8a
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0008000000016650-43.dat warzonerat behavioral1/files/0x000800000001628b-78.dat warzonerat behavioral1/files/0x000a0000000164b1-92.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
resource yara_rule behavioral1/files/0x0008000000016650-43.dat aspack_v212_v242 behavioral1/files/0x000800000001628b-78.dat aspack_v212_v242 behavioral1/files/0x000a0000000164b1-92.dat aspack_v212_v242 -
Executes dropped EXE 13 IoCs
pid Process 1900 explorer.exe 620 explorer.exe 2520 spoolsv.exe 2260 spoolsv.exe 2440 spoolsv.exe 1104 spoolsv.exe 2420 spoolsv.exe 2288 spoolsv.exe 2384 spoolsv.exe 2668 spoolsv.exe 1752 spoolsv.exe 1588 spoolsv.exe 3024 svchost.exe -
Loads dropped DLL 64 IoCs
pid Process 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 2236 WerFault.exe 620 explorer.exe 620 explorer.exe 1576 WerFault.exe 1576 WerFault.exe 1576 WerFault.exe 1576 WerFault.exe 1576 WerFault.exe 1576 WerFault.exe 1576 WerFault.exe 620 explorer.exe 620 explorer.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 620 explorer.exe 620 explorer.exe 920 WerFault.exe 920 WerFault.exe 920 WerFault.exe 920 WerFault.exe 920 WerFault.exe 920 WerFault.exe 920 WerFault.exe 620 explorer.exe 620 explorer.exe 1020 WerFault.exe 1020 WerFault.exe 1020 WerFault.exe 1020 WerFault.exe 1020 WerFault.exe 1020 WerFault.exe 1020 WerFault.exe 620 explorer.exe 620 explorer.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 620 explorer.exe 620 explorer.exe 2696 WerFault.exe 2696 WerFault.exe 2696 WerFault.exe 2696 WerFault.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2452 set thread context of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 set thread context of 1252 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 32 PID 1900 set thread context of 620 1900 explorer.exe 34 PID 1900 set thread context of 1560 1900 explorer.exe 35 PID 2520 set thread context of 1588 2520 spoolsv.exe 53 PID 2520 set thread context of 2508 2520 spoolsv.exe 54 -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2236 2260 WerFault.exe 1576 2440 WerFault.exe 39 900 1104 WerFault.exe 41 920 2420 WerFault.exe 43 1020 2288 WerFault.exe 45 2804 2384 WerFault.exe 28 2696 2668 WerFault.exe 2828 1752 WerFault.exe -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 620 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 620 explorer.exe 1588 spoolsv.exe 1588 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 2676 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 31 PID 2452 wrote to memory of 1252 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 32 PID 2452 wrote to memory of 1252 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 32 PID 2452 wrote to memory of 1252 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 32 PID 2452 wrote to memory of 1252 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 32 PID 2452 wrote to memory of 1252 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 32 PID 2452 wrote to memory of 1252 2452 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 32 PID 2676 wrote to memory of 1900 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 33 PID 2676 wrote to memory of 1900 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 33 PID 2676 wrote to memory of 1900 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 33 PID 2676 wrote to memory of 1900 2676 dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe 33 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 620 1900 explorer.exe 34 PID 1900 wrote to memory of 1560 1900 explorer.exe 35 PID 1900 wrote to memory of 1560 1900 explorer.exe 35 PID 1900 wrote to memory of 1560 1900 explorer.exe 35 PID 1900 wrote to memory of 1560 1900 explorer.exe 35 PID 1900 wrote to memory of 1560 1900 explorer.exe 35 PID 1900 wrote to memory of 1560 1900 explorer.exe 35 PID 620 wrote to memory of 2520 620 explorer.exe 36 PID 620 wrote to memory of 2520 620 explorer.exe 36 PID 620 wrote to memory of 2520 620 explorer.exe 36 PID 620 wrote to memory of 2520 620 explorer.exe 36 PID 620 wrote to memory of 2260 620 explorer.exe 37 PID 620 wrote to memory of 2260 620 explorer.exe 37 PID 620 wrote to memory of 2260 620 explorer.exe 37 PID 620 wrote to memory of 2260 620 explorer.exe 37 PID 2260 wrote to memory of 2236 2260 spoolsv.exe 38 PID 2260 wrote to memory of 2236 2260 spoolsv.exe 38 PID 2260 wrote to memory of 2236 2260 spoolsv.exe 38 PID 2260 wrote to memory of 2236 2260 spoolsv.exe 38 PID 620 wrote to memory of 2440 620 explorer.exe 39 PID 620 wrote to memory of 2440 620 explorer.exe 39 PID 620 wrote to memory of 2440 620 explorer.exe 39 PID 620 wrote to memory of 2440 620 explorer.exe 39 PID 2440 wrote to memory of 1576 2440 spoolsv.exe 40 PID 2440 wrote to memory of 1576 2440 spoolsv.exe 40 PID 2440 wrote to memory of 1576 2440 spoolsv.exe 40 PID 2440 wrote to memory of 1576 2440 spoolsv.exe 40 PID 620 wrote to memory of 1104 620 explorer.exe 41 PID 620 wrote to memory of 1104 620 explorer.exe 41 PID 620 wrote to memory of 1104 620 explorer.exe 41 PID 620 wrote to memory of 1104 620 explorer.exe 41 PID 1104 wrote to memory of 900 1104 spoolsv.exe 42 PID 1104 wrote to memory of 900 1104 spoolsv.exe 42 PID 1104 wrote to memory of 900 1104 spoolsv.exe 42 PID 1104 wrote to memory of 900 1104 spoolsv.exe 42 PID 620 wrote to memory of 2420 620 explorer.exe 43 PID 620 wrote to memory of 2420 620 explorer.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe"C:\Users\Admin\AppData\Local\Temp\dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe"C:\Users\Admin\AppData\Local\Temp\dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1588 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2236
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 366⤵
- Loads dropped DLL
- Program crash
PID:900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 366⤵
- Loads dropped DLL
- Program crash
PID:920
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 366⤵
- Program crash
PID:2828
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵PID:1560
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵PID:1252
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD5f3dd3a2b20e6be24171a37f548221c8f
SHA11b405add2b15b47be75aab4e7d2dc60e487d54b6
SHA256dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76
SHA51204eb816ec4104efd65995f8f4051767fcee142bba12ce6249d7eb01c4bd99b473a4f9ca9615284256354a97fa69e0b1f4631cface91c172abb3f625acff994b2
-
Filesize
8.2MB
MD506371de74390351f1f7c163be53c52b0
SHA13a07ab1bb45b095ce21321481686a77f5a139b01
SHA256d70f4667d204662b4e679dfbf731d3d6de1c4fd6b9e637e4f189580a1086f03d
SHA512d19e4202339c75aec0054abbc3711fc06c0f5b5f008789fe07134427e4a27f202995340b2df152184a027f2ca791b485065d17e2c76f5324da45ee2d0707e842
-
Filesize
8.2MB
MD5d8d3f8f213f434f3eed08caf3b7ed707
SHA17a2737005c41e31aaedb8c36d3a158f40745e160
SHA2564c7053ef0e174bed37e619523bb8158aee7618899209b6ac1799382042c48c7f
SHA512c063c3d675a92fe4199ca187e6314392e7ede68908e78c039a6cf922a5c7990cafe6975b39473eff5a86707d0d64c0cda52c67894693ec322fd85682bb25a646