Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 07:19
Behavioral task
behavioral1
Sample
c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe
Resource
win10v2004-20241007-en
General
-
Target
c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe
-
Size
8.2MB
-
MD5
d7404aebb2a9341fa26898f87b622220
-
SHA1
0c467caf2ec6fcc6b74247fad9e47970ffe793f4
-
SHA256
c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7
-
SHA512
9bce78fc38831e87cdd2a2eb254139885b51627d895b251f872339fa554340b356b5c4ae6dd8290961be623251245fa439038625935637f60c10b7c2e48ae223
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecc:V8e8e8f8e8e8J
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0008000000014864-42.dat warzonerat behavioral1/files/0x0008000000014714-76.dat warzonerat behavioral1/files/0x0008000000014a05-98.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
resource yara_rule behavioral1/files/0x0008000000014864-42.dat aspack_v212_v242 behavioral1/files/0x0008000000014714-76.dat aspack_v212_v242 behavioral1/files/0x0008000000014a05-98.dat aspack_v212_v242 -
Executes dropped EXE 13 IoCs
pid Process 2556 explorer.exe 2308 explorer.exe 2480 spoolsv.exe 1616 spoolsv.exe 2132 spoolsv.exe 1088 spoolsv.exe 1328 spoolsv.exe 1860 spoolsv.exe 1508 spoolsv.exe 2936 spoolsv.exe 2832 spoolsv.exe 2640 spoolsv.exe 2728 svchost.exe -
Loads dropped DLL 64 IoCs
pid Process 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2720 WerFault.exe 2720 WerFault.exe 2720 WerFault.exe 2720 WerFault.exe 2720 WerFault.exe 2720 WerFault.exe 2720 WerFault.exe 2308 explorer.exe 2308 explorer.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2308 explorer.exe 2308 explorer.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 2308 explorer.exe 2308 explorer.exe 1752 WerFault.exe 1752 WerFault.exe 1752 WerFault.exe 1752 WerFault.exe 1752 WerFault.exe 1752 WerFault.exe 1752 WerFault.exe 2308 explorer.exe 2308 explorer.exe 880 WerFault.exe 880 WerFault.exe 880 WerFault.exe 880 WerFault.exe 880 WerFault.exe 880 WerFault.exe 880 WerFault.exe 2308 explorer.exe 2308 explorer.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 2308 explorer.exe 2308 explorer.exe 2460 WerFault.exe 2460 WerFault.exe 2460 WerFault.exe 2460 WerFault.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2416 set thread context of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 set thread context of 2960 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 31 PID 2556 set thread context of 2308 2556 explorer.exe 33 PID 2556 set thread context of 1444 2556 explorer.exe 34 PID 2480 set thread context of 2640 2480 spoolsv.exe 52 PID 2480 set thread context of 2528 2480 spoolsv.exe 53 -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2720 1616 WerFault.exe 36 2888 2132 WerFault.exe 38 3000 1088 WerFault.exe 40 1752 1328 WerFault.exe 42 880 1860 WerFault.exe 44 1568 1508 WerFault.exe 46 2460 2936 WerFault.exe 48 2776 2832 WerFault.exe 50 -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2308 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2640 spoolsv.exe 2640 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 3036 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 30 PID 2416 wrote to memory of 2960 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 31 PID 2416 wrote to memory of 2960 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 31 PID 2416 wrote to memory of 2960 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 31 PID 2416 wrote to memory of 2960 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 31 PID 2416 wrote to memory of 2960 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 31 PID 2416 wrote to memory of 2960 2416 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 31 PID 3036 wrote to memory of 2556 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 32 PID 3036 wrote to memory of 2556 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 32 PID 3036 wrote to memory of 2556 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 32 PID 3036 wrote to memory of 2556 3036 c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe 32 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 2308 2556 explorer.exe 33 PID 2556 wrote to memory of 1444 2556 explorer.exe 34 PID 2556 wrote to memory of 1444 2556 explorer.exe 34 PID 2556 wrote to memory of 1444 2556 explorer.exe 34 PID 2556 wrote to memory of 1444 2556 explorer.exe 34 PID 2556 wrote to memory of 1444 2556 explorer.exe 34 PID 2556 wrote to memory of 1444 2556 explorer.exe 34 PID 2308 wrote to memory of 2480 2308 explorer.exe 35 PID 2308 wrote to memory of 2480 2308 explorer.exe 35 PID 2308 wrote to memory of 2480 2308 explorer.exe 35 PID 2308 wrote to memory of 2480 2308 explorer.exe 35 PID 2308 wrote to memory of 1616 2308 explorer.exe 36 PID 2308 wrote to memory of 1616 2308 explorer.exe 36 PID 2308 wrote to memory of 1616 2308 explorer.exe 36 PID 2308 wrote to memory of 1616 2308 explorer.exe 36 PID 1616 wrote to memory of 2720 1616 spoolsv.exe 37 PID 1616 wrote to memory of 2720 1616 spoolsv.exe 37 PID 1616 wrote to memory of 2720 1616 spoolsv.exe 37 PID 1616 wrote to memory of 2720 1616 spoolsv.exe 37 PID 2308 wrote to memory of 2132 2308 explorer.exe 38 PID 2308 wrote to memory of 2132 2308 explorer.exe 38 PID 2308 wrote to memory of 2132 2308 explorer.exe 38 PID 2308 wrote to memory of 2132 2308 explorer.exe 38 PID 2132 wrote to memory of 2888 2132 spoolsv.exe 39 PID 2132 wrote to memory of 2888 2132 spoolsv.exe 39 PID 2132 wrote to memory of 2888 2132 spoolsv.exe 39 PID 2132 wrote to memory of 2888 2132 spoolsv.exe 39 PID 2308 wrote to memory of 1088 2308 explorer.exe 40 PID 2308 wrote to memory of 1088 2308 explorer.exe 40 PID 2308 wrote to memory of 1088 2308 explorer.exe 40 PID 2308 wrote to memory of 1088 2308 explorer.exe 40 PID 1088 wrote to memory of 3000 1088 spoolsv.exe 41 PID 1088 wrote to memory of 3000 1088 spoolsv.exe 41 PID 1088 wrote to memory of 3000 1088 spoolsv.exe 41 PID 1088 wrote to memory of 3000 1088 spoolsv.exe 41 PID 2308 wrote to memory of 1328 2308 explorer.exe 42 PID 2308 wrote to memory of 1328 2308 explorer.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe"C:\Users\Admin\AppData\Local\Temp\c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe"C:\Users\Admin\AppData\Local\Temp\c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7N.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2640 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2720
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2888
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 366⤵
- Loads dropped DLL
- Program crash
PID:3000
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 366⤵
- Loads dropped DLL
- Program crash
PID:880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1568
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 366⤵
- Program crash
PID:2776
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵PID:1444
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵PID:2960
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD5d7404aebb2a9341fa26898f87b622220
SHA10c467caf2ec6fcc6b74247fad9e47970ffe793f4
SHA256c4f5bb72347c9d34250652b1316c4b4ad943d174d30c7b049525d172ebb27bc7
SHA5129bce78fc38831e87cdd2a2eb254139885b51627d895b251f872339fa554340b356b5c4ae6dd8290961be623251245fa439038625935637f60c10b7c2e48ae223
-
Filesize
8.2MB
MD57d56081a197751d66d808d9c94dca4cd
SHA1721edecd1de504fdf3fe40bfefe7dc46edf7a266
SHA25633f8bcc9fd18cf2e8240d27644f460aa28eb34450c405abc61f64fcef15e5f43
SHA5121aefc7eaf81140aa36451385f23eebba8357c59555136e6825fe1118e5ac03dd7243b4b5097b01bf677c51e04236d8e75b8099ae9d45a7bfac5b855dceaf2cce
-
Filesize
8.2MB
MD58cb349dc9bfb0095a0a0bc0a6c0165ba
SHA1fbe4374b0ac42b07de928f504d31b515519ec30f
SHA256f4f4a1c0bf30e3f3d4386cd94c049a58006d8fc7255729d32c5edb8d82ac8634
SHA51267bf2a35667c7dc224369ae7cd5ed290d90e9353f4fe79951991b3bb70e879ad1c066a75c6ee17c62179a0b21b857ce34adb36b21ca9635a437f175d8d2a1020