Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
29-10-2024 02:28
Behavioral task
behavioral1
Sample
37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe
Resource
win10v2004-20241007-en
General
-
Target
37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe
-
Size
2.9MB
-
MD5
7d39c75167c84c2cc8154a967a977e60
-
SHA1
c5b2ad550cca9ad354b5650d99539bbc20413fba
-
SHA256
37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5
-
SHA512
f2560b805dc45d88d209c497c1f93351235730731c7e1849c1a72a45ca1c9a8c225c6e9aba79f2032d55961bf4afcdf97eb64b0ffd3daa66fd90d58aec14e5b7
-
SSDEEP
24576:eTy7ASmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHL:eTy7ASmw4gxeOw46fUbNecCCFbNecQ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0008000000016c88-94.dat warzonerat behavioral1/files/0x0008000000016b47-166.dat warzonerat behavioral1/files/0x0008000000016cd7-181.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 13 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 30 IoCs
pid Process 1644 explorer.exe 2128 explorer.exe 796 explorer.exe 1388 spoolsv.exe 2216 spoolsv.exe 1572 spoolsv.exe 1532 spoolsv.exe 2600 spoolsv.exe 2960 spoolsv.exe 1340 spoolsv.exe 2068 spoolsv.exe 1576 spoolsv.exe 1504 spoolsv.exe 2620 spoolsv.exe 1672 spoolsv.exe 1168 spoolsv.exe 1628 spoolsv.exe 1044 spoolsv.exe 2116 spoolsv.exe 2544 spoolsv.exe 2984 spoolsv.exe 2320 spoolsv.exe 2440 spoolsv.exe 1972 spoolsv.exe 2468 spoolsv.exe 2644 spoolsv.exe 912 spoolsv.exe 1116 spoolsv.exe 608 spoolsv.exe 2108 spoolsv.exe -
Loads dropped DLL 44 IoCs
pid Process 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 796 explorer.exe 796 explorer.exe 1388 spoolsv.exe 796 explorer.exe 796 explorer.exe 1572 spoolsv.exe 796 explorer.exe 796 explorer.exe 2600 spoolsv.exe 796 explorer.exe 796 explorer.exe 1340 spoolsv.exe 796 explorer.exe 796 explorer.exe 1576 spoolsv.exe 796 explorer.exe 796 explorer.exe 2620 spoolsv.exe 796 explorer.exe 796 explorer.exe 1168 spoolsv.exe 796 explorer.exe 796 explorer.exe 1044 spoolsv.exe 796 explorer.exe 796 explorer.exe 2544 spoolsv.exe 796 explorer.exe 796 explorer.exe 2320 spoolsv.exe 796 explorer.exe 796 explorer.exe 1972 spoolsv.exe 796 explorer.exe 796 explorer.exe 2644 spoolsv.exe 796 explorer.exe 796 explorer.exe 1116 spoolsv.exe 796 explorer.exe 796 explorer.exe 2108 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 19 IoCs
description pid Process procid_target PID 2172 set thread context of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 1660 set thread context of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 set thread context of 1812 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 35 PID 1644 set thread context of 2128 1644 explorer.exe 39 PID 2128 set thread context of 796 2128 explorer.exe 40 PID 2128 set thread context of 2296 2128 explorer.exe 41 PID 1388 set thread context of 2216 1388 spoolsv.exe 45 PID 1572 set thread context of 1532 1572 spoolsv.exe 49 PID 2600 set thread context of 2960 2600 spoolsv.exe 52 PID 1340 set thread context of 2068 1340 spoolsv.exe 56 PID 1576 set thread context of 1504 1576 spoolsv.exe 60 PID 2620 set thread context of 1672 2620 spoolsv.exe 64 PID 1168 set thread context of 1628 1168 spoolsv.exe 68 PID 1044 set thread context of 2116 1044 spoolsv.exe 72 PID 2544 set thread context of 2984 2544 spoolsv.exe 76 PID 2320 set thread context of 2440 2320 spoolsv.exe 80 PID 1972 set thread context of 2468 1972 spoolsv.exe 84 PID 2644 set thread context of 912 2644 spoolsv.exe 88 PID 1116 set thread context of 608 1116 spoolsv.exe 92 -
Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 1644 explorer.exe 1388 spoolsv.exe 796 explorer.exe 796 explorer.exe 1572 spoolsv.exe 796 explorer.exe 2600 spoolsv.exe 796 explorer.exe 1340 spoolsv.exe 796 explorer.exe 1576 spoolsv.exe 796 explorer.exe 2620 spoolsv.exe 796 explorer.exe 1168 spoolsv.exe 796 explorer.exe 1044 spoolsv.exe 796 explorer.exe 2544 spoolsv.exe 796 explorer.exe 2320 spoolsv.exe 796 explorer.exe 1972 spoolsv.exe 796 explorer.exe 2644 spoolsv.exe 796 explorer.exe 1116 spoolsv.exe 796 explorer.exe 2108 spoolsv.exe -
Suspicious use of SetWindowsHookEx 38 IoCs
pid Process 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 1644 explorer.exe 1644 explorer.exe 796 explorer.exe 796 explorer.exe 1388 spoolsv.exe 1388 spoolsv.exe 796 explorer.exe 796 explorer.exe 1572 spoolsv.exe 1572 spoolsv.exe 2600 spoolsv.exe 2600 spoolsv.exe 1340 spoolsv.exe 1340 spoolsv.exe 1576 spoolsv.exe 1576 spoolsv.exe 2620 spoolsv.exe 2620 spoolsv.exe 1168 spoolsv.exe 1168 spoolsv.exe 1044 spoolsv.exe 1044 spoolsv.exe 2544 spoolsv.exe 2544 spoolsv.exe 2320 spoolsv.exe 2320 spoolsv.exe 1972 spoolsv.exe 1972 spoolsv.exe 2644 spoolsv.exe 2644 spoolsv.exe 1116 spoolsv.exe 1116 spoolsv.exe 2108 spoolsv.exe 2108 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2324 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 30 PID 2172 wrote to memory of 2324 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 30 PID 2172 wrote to memory of 2324 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 30 PID 2172 wrote to memory of 2324 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 30 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 2172 wrote to memory of 1660 2172 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 32 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 2720 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 34 PID 1660 wrote to memory of 1812 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 35 PID 1660 wrote to memory of 1812 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 35 PID 1660 wrote to memory of 1812 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 35 PID 1660 wrote to memory of 1812 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 35 PID 1660 wrote to memory of 1812 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 35 PID 1660 wrote to memory of 1812 1660 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 35 PID 2720 wrote to memory of 1644 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 36 PID 2720 wrote to memory of 1644 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 36 PID 2720 wrote to memory of 1644 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 36 PID 2720 wrote to memory of 1644 2720 37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe 36 PID 1644 wrote to memory of 2676 1644 explorer.exe 37 PID 1644 wrote to memory of 2676 1644 explorer.exe 37 PID 1644 wrote to memory of 2676 1644 explorer.exe 37 PID 1644 wrote to memory of 2676 1644 explorer.exe 37 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39 PID 1644 wrote to memory of 2128 1644 explorer.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe"C:\Users\Admin\AppData\Local\Temp\37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exeC:\Users\Admin\AppData\Local\Temp\37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exeC:\Users\Admin\AppData\Local\Temp\37d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5N.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2676
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2128 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2896
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1972
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1504
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:960
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2964
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1340
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1576
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2796
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:608
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2172
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1764
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2296
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:1812
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD57d39c75167c84c2cc8154a967a977e60
SHA1c5b2ad550cca9ad354b5650d99539bbc20413fba
SHA25637d734daa68d24e8348065e9627797a606d4451ade85b4726034948f988874a5
SHA512f2560b805dc45d88d209c497c1f93351235730731c7e1849c1a72a45ca1c9a8c225c6e9aba79f2032d55961bf4afcdf97eb64b0ffd3daa66fd90d58aec14e5b7
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
2.9MB
MD51fca653f4243b8dc14766ce9c9c7ae14
SHA1cb23857bffbff378007f0235974ba2b0837d9a2e
SHA25693ce5f2a031fd7e161061caa30b4a837f29eb8bcc438863ebdff25b3b3adb3ca
SHA51214f27a527437bbe511eb37aad32618058744080fac325f79e476c1387fad8423bc67c2205b370d4f79da46b853ab1e85eecb232b01dbce83c038c8a63936f9fc
-
Filesize
2.9MB
MD53a5be222c93bc825989d516eea50911e
SHA1cdbb58cabff7547d643721078d32d99fd65d4ccc
SHA2568bee09b272e4eb64d0eeecb5e8b9f412a7f0b5914cda5dc1d84a4a9d789c11ea
SHA51257a88ce62e504346dae6c6fbd19c8f2bad28e24ac646ef879def36ed01a0adbf08e56a8e2d10e70480bf6e873950aa5b5d1a3bb7a354c7cd591e40fb666be202