warzonerat | acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
Size

8.2MB
MD5

289d273ac47a0259b639ff6d4782cab0
SHA1

fed3a1db04bb8fe8104ff15d984d02cdbd0e360d
SHA256

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2
SHA512

384bfe5eee39302ac9795550a5bdcbeecf409bc7eb92d5c55aa293ba56f6acbbc48585affd03ea124cb5a2b8d5aaa5d1741c3b98387325253cc22892a6b5b735
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecX:V8e8e8f8e8e8s

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/files/0x0008000000015d48-41.dat	warzonerat
behavioral1/files/0x0009000000015cdd-78.dat	warzonerat
behavioral1/files/0x0008000000015d68-91.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
behavioral1/files/0x0008000000015d48-41.dat	aspack_v212_v242
behavioral1/files/0x0009000000015cdd-78.dat	aspack_v212_v242
behavioral1/files/0x0008000000015d68-91.dat	aspack_v212_v242

Executes dropped EXE 9 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	Process
2604	explorer.exe
2104	explorer.exe
2888	spoolsv.exe
2188	spoolsv.exe
1996	spoolsv.exe
1992	spoolsv.exe
1396	spoolsv.exe
1872	spoolsv.exe
2224	spoolsv.exe

Loads dropped DLL 58 IoCs

Processes:

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeexplorer.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	Process
2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
2104	explorer.exe
2104	explorer.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
2104	explorer.exe
2104	explorer.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
2104	explorer.exe
2104	explorer.exe
568	WerFault.exe
568	WerFault.exe
568	WerFault.exe
568	WerFault.exe
568	WerFault.exe
568	WerFault.exe
568	WerFault.exe
2104	explorer.exe
2104	explorer.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
3008	WerFault.exe
2104	explorer.exe
2104	explorer.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeexplorer.exeexplorer.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeexplorer.exe

description	pid	Process	procid_target
PID 2376 set thread context of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 set thread context of 2192	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	32
PID 2604 set thread context of 2104	2604	explorer.exe	35
PID 2604 set thread context of 1236	2604	explorer.exe	36

Drops file in Windows directory 3 IoCs

Processes:

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeexplorer.exe

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
1696	2188	WerFault.exe	38
1148	1996	WerFault.exe
1452	1992	WerFault.exe	42
568	1396	WerFault.exe	44
3008	1872	WerFault.exe
1636	2224	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

spoolsv.exespoolsv.exespoolsv.exeacf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeacf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeexplorer.exe

pid	Process
2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeexplorer.exe

pid	Process
2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeacf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	Process	procid_target
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2804	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	31
PID 2376 wrote to memory of 2192	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	32
PID 2376 wrote to memory of 2192	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	32
PID 2376 wrote to memory of 2192	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	32
PID 2376 wrote to memory of 2192	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	32
PID 2376 wrote to memory of 2192	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	32
PID 2376 wrote to memory of 2192	2376	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	32
PID 2804 wrote to memory of 2604	2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	33
PID 2804 wrote to memory of 2604	2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	33
PID 2804 wrote to memory of 2604	2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	33
PID 2804 wrote to memory of 2604	2804	acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe	33
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 2104	2604	explorer.exe	35
PID 2604 wrote to memory of 1236	2604	explorer.exe	36
PID 2604 wrote to memory of 1236	2604	explorer.exe	36
PID 2604 wrote to memory of 1236	2604	explorer.exe	36
PID 2604 wrote to memory of 1236	2604	explorer.exe	36
PID 2604 wrote to memory of 1236	2604	explorer.exe	36
PID 2604 wrote to memory of 1236	2604	explorer.exe	36
PID 2104 wrote to memory of 2888	2104	explorer.exe	37
PID 2104 wrote to memory of 2888	2104	explorer.exe	37
PID 2104 wrote to memory of 2888	2104	explorer.exe	37
PID 2104 wrote to memory of 2888	2104	explorer.exe	37
PID 2104 wrote to memory of 2188	2104	explorer.exe	38
PID 2104 wrote to memory of 2188	2104	explorer.exe	38
PID 2104 wrote to memory of 2188	2104	explorer.exe	38
PID 2104 wrote to memory of 2188	2104	explorer.exe	38
PID 2188 wrote to memory of 1696	2188	spoolsv.exe	39
PID 2188 wrote to memory of 1696	2188	spoolsv.exe	39
PID 2188 wrote to memory of 1696	2188	spoolsv.exe	39
PID 2188 wrote to memory of 1696	2188	spoolsv.exe	39
PID 2104 wrote to memory of 1996	2104	explorer.exe	40
PID 2104 wrote to memory of 1996	2104	explorer.exe	40
PID 2104 wrote to memory of 1996	2104	explorer.exe	40
PID 2104 wrote to memory of 1996	2104	explorer.exe	40
PID 1996 wrote to memory of 1148	1996	spoolsv.exe	41
PID 1996 wrote to memory of 1148	1996	spoolsv.exe	41
PID 1996 wrote to memory of 1148	1996	spoolsv.exe	41
PID 1996 wrote to memory of 1148	1996	spoolsv.exe	41
PID 2104 wrote to memory of 1992	2104	explorer.exe	42
PID 2104 wrote to memory of 1992	2104	explorer.exe	42
PID 2104 wrote to memory of 1992	2104	explorer.exe	42
PID 2104 wrote to memory of 1992	2104	explorer.exe	42
PID 1992 wrote to memory of 1452	1992	spoolsv.exe	43
PID 1992 wrote to memory of 1452	1992	spoolsv.exe	43
PID 1992 wrote to memory of 1452	1992	spoolsv.exe	43
PID 1992 wrote to memory of 1452	1992	spoolsv.exe	43
PID 2104 wrote to memory of 1396	2104	explorer.exe	44
PID 2104 wrote to memory of 1396	2104	explorer.exe	44

C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
"C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
  "C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:3008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1636
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:1236
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.2MB

MD5
289d273ac47a0259b639ff6d4782cab0

SHA1
fed3a1db04bb8fe8104ff15d984d02cdbd0e360d

SHA256
acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2

SHA512
384bfe5eee39302ac9795550a5bdcbeecf409bc7eb92d5c55aa293ba56f6acbbc48585affd03ea124cb5a2b8d5aaa5d1741c3b98387325253cc22892a6b5b735

Download Submit
C:\Windows\system\explorer.exe

Filesize
8.2MB

MD5
9b22416a65cbdda8a997b6566d4a0419

SHA1
6f6a8082d106f998ea3dbb31e9bba6bf8fa853c2

SHA256
c5c8ae629f218e7b4ee2c4112f5328c4f455b8b333d60bc811764037005cc6bf

SHA512
8fad737048b09f900ce0c23d75264b1ecfed30473c19bf972667ebc0b1adc152fc1be2217460afd1c16fcb75480c60308596e9580356349275240f2b74a2e9b3

Download Submit
\Windows\system\spoolsv.exe

Filesize
8.2MB

MD5
b0d5043943ade77d47f20326c8fd581d

SHA1
9434397fb05781ddeb7c2a5d99bbd69dd1b668fb

SHA256
55db93a05468af2fb42ead3ede6be64f3c135125500cdb1c6484bb70d8da05a1

SHA512
6c22bc95b45872150de7fc2feb81b40ce6de39d7fbcb545b7436f2655bded9ec49ece4f70ff25cd4962706c0f6896f16fce38f4dd73b8ad2f8dc52d049313b52

Download Submit
memory/1236-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1992-154-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1996-132-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2104-144-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2104-143-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-142-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-131-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-162-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-133-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-196-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-121-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2104-111-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-206-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-98-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-93-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2104-170-0x0000000003140000-0x0000000003254000-memory.dmp

Filesize
1.1MB

Download
memory/2188-122-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2188-113-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2192-33-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2192-38-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2192-30-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2192-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-36-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2224-205-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2376-40-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2376-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2376-6-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2376-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2376-3-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2376-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2376-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2376-23-0x00000000031C0000-0x00000000032D4000-memory.dmp

Filesize
1.1MB

Download
memory/2604-51-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2604-56-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2604-54-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2604-88-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2604-53-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2604-52-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2804-45-0x0000000003190000-0x00000000032A4000-memory.dmp

Filesize
1.1MB

Download
memory/2804-18-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2888-141-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2888-100-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2888-101-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download