Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2024 13:42
Behavioral task
behavioral1
Sample
ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe
Resource
win10v2004-20241007-en
General
-
Target
ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe
-
Size
8.8MB
-
MD5
17d0b1dfbf54177c8daafabfd20116c0
-
SHA1
35387810a5db26159c6b72ee1985df219d67b33a
-
SHA256
ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66
-
SHA512
eb2e4881cb3d9df6f707f4e023bd4bc03ef290c41d0e2e12934b089c32a79c31508a658e571c6ea4aec6bac4abd7fc399a41369aef65f6a90cbe302351c7f845
-
SSDEEP
49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecJ:K1+8e8e8f8e8e8c
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral2/files/0x000b000000023bab-19.dat warzonerat behavioral2/files/0x000a000000023ba9-34.dat warzonerat behavioral2/files/0x000b000000023bae-49.dat warzonerat behavioral2/files/0x000b000000023bae-177.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Executes dropped EXE 58 IoCs
pid Process 4920 explorer.exe 4896 explorer.exe 3656 spoolsv.exe 1000 spoolsv.exe 4352 spoolsv.exe 2280 spoolsv.exe 1552 spoolsv.exe 2188 spoolsv.exe 3488 spoolsv.exe 232 spoolsv.exe 2916 spoolsv.exe 3888 spoolsv.exe 2808 spoolsv.exe 4080 spoolsv.exe 4460 spoolsv.exe 3252 spoolsv.exe 4160 spoolsv.exe 640 spoolsv.exe 4084 spoolsv.exe 2076 spoolsv.exe 3692 spoolsv.exe 4812 spoolsv.exe 5112 spoolsv.exe 2656 spoolsv.exe 312 spoolsv.exe 3868 spoolsv.exe 996 spoolsv.exe 2216 spoolsv.exe 1512 spoolsv.exe 1192 spoolsv.exe 4376 spoolsv.exe 3236 spoolsv.exe 4816 spoolsv.exe 3428 spoolsv.exe 2072 spoolsv.exe 592 spoolsv.exe 968 spoolsv.exe 1576 spoolsv.exe 3872 spoolsv.exe 2988 spoolsv.exe 1456 spoolsv.exe 184 spoolsv.exe 3968 spoolsv.exe 1372 spoolsv.exe 4496 spoolsv.exe 792 spoolsv.exe 5036 spoolsv.exe 2008 spoolsv.exe 2404 spoolsv.exe 3800 spoolsv.exe 2196 spoolsv.exe 1268 spoolsv.exe 4116 spoolsv.exe 3164 spoolsv.exe 1496 spoolsv.exe 2084 spoolsv.exe 2616 spoolsv.exe 2156 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1708 set thread context of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 set thread context of 2344 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 98 PID 4920 set thread context of 4896 4920 explorer.exe 101 PID 4920 set thread context of 4000 4920 explorer.exe 102 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 59 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 3060 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3060 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 3060 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe 4896 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 wrote to memory of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 wrote to memory of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 wrote to memory of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 wrote to memory of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 wrote to memory of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 wrote to memory of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 wrote to memory of 3060 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 97 PID 1708 wrote to memory of 2344 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 98 PID 1708 wrote to memory of 2344 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 98 PID 1708 wrote to memory of 2344 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 98 PID 1708 wrote to memory of 2344 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 98 PID 1708 wrote to memory of 2344 1708 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 98 PID 3060 wrote to memory of 4920 3060 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 99 PID 3060 wrote to memory of 4920 3060 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 99 PID 3060 wrote to memory of 4920 3060 ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe 99 PID 4920 wrote to memory of 4896 4920 explorer.exe 101 PID 4920 wrote to memory of 4896 4920 explorer.exe 101 PID 4920 wrote to memory of 4896 4920 explorer.exe 101 PID 4920 wrote to memory of 4896 4920 explorer.exe 101 PID 4920 wrote to memory of 4896 4920 explorer.exe 101 PID 4920 wrote to memory of 4896 4920 explorer.exe 101 PID 4920 wrote to memory of 4896 4920 explorer.exe 101 PID 4920 wrote to memory of 4896 4920 explorer.exe 101 PID 4920 wrote to memory of 4000 4920 explorer.exe 102 PID 4920 wrote to memory of 4000 4920 explorer.exe 102 PID 4920 wrote to memory of 4000 4920 explorer.exe 102 PID 4920 wrote to memory of 4000 4920 explorer.exe 102 PID 4920 wrote to memory of 4000 4920 explorer.exe 102 PID 4896 wrote to memory of 3656 4896 explorer.exe 103 PID 4896 wrote to memory of 3656 4896 explorer.exe 103 PID 4896 wrote to memory of 3656 4896 explorer.exe 103 PID 4896 wrote to memory of 1000 4896 explorer.exe 104 PID 4896 wrote to memory of 1000 4896 explorer.exe 104 PID 4896 wrote to memory of 1000 4896 explorer.exe 104 PID 4896 wrote to memory of 4352 4896 explorer.exe 105 PID 4896 wrote to memory of 4352 4896 explorer.exe 105 PID 4896 wrote to memory of 4352 4896 explorer.exe 105 PID 4896 wrote to memory of 2280 4896 explorer.exe 106 PID 4896 wrote to memory of 2280 4896 explorer.exe 106 PID 4896 wrote to memory of 2280 4896 explorer.exe 106 PID 4896 wrote to memory of 1552 4896 explorer.exe 107 PID 4896 wrote to memory of 1552 4896 explorer.exe 107 PID 4896 wrote to memory of 1552 4896 explorer.exe 107 PID 4896 wrote to memory of 2188 4896 explorer.exe 108 PID 4896 wrote to memory of 2188 4896 explorer.exe 108 PID 4896 wrote to memory of 2188 4896 explorer.exe 108 PID 4896 wrote to memory of 3488 4896 explorer.exe 109 PID 4896 wrote to memory of 3488 4896 explorer.exe 109 PID 4896 wrote to memory of 3488 4896 explorer.exe 109 PID 4896 wrote to memory of 232 4896 explorer.exe 110 PID 4896 wrote to memory of 232 4896 explorer.exe 110 PID 4896 wrote to memory of 232 4896 explorer.exe 110 PID 4896 wrote to memory of 2916 4896 explorer.exe 111 PID 4896 wrote to memory of 2916 4896 explorer.exe 111 PID 4896 wrote to memory of 2916 4896 explorer.exe 111 PID 4896 wrote to memory of 3888 4896 explorer.exe 112 PID 4896 wrote to memory of 3888 4896 explorer.exe 112 PID 4896 wrote to memory of 3888 4896 explorer.exe 112 PID 4896 wrote to memory of 2808 4896 explorer.exe 113 PID 4896 wrote to memory of 2808 4896 explorer.exe 113 PID 4896 wrote to memory of 2808 4896 explorer.exe 113 PID 4896 wrote to memory of 4080 4896 explorer.exe 114 PID 4896 wrote to memory of 4080 4896 explorer.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe"C:\Users\Admin\AppData\Local\Temp\ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe"C:\Users\Admin\AppData\Local\Temp\ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4352
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:232
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4080
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3252
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:640
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4084
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2076
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3692
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5112
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:312
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3428
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:592
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:184
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1372
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:792
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3800
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2196
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2616
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2156
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵PID:4000
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵PID:2344
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.8MB
MD517d0b1dfbf54177c8daafabfd20116c0
SHA135387810a5db26159c6b72ee1985df219d67b33a
SHA256ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66
SHA512eb2e4881cb3d9df6f707f4e023bd4bc03ef290c41d0e2e12934b089c32a79c31508a658e571c6ea4aec6bac4abd7fc399a41369aef65f6a90cbe302351c7f845
-
Filesize
8.9MB
MD56b596423118161533f1f9940cdac22a3
SHA101ee3bc05ef13b1d9e410dc9642b5b9db6847e49
SHA2569a402a60284bba766bae6925a470a4bdf3c526cb2071577a60b9fb683d87377e
SHA512e873a5fbefb3095c6e7221d2aee6544bcc688768022da3988e40fbabcf6b8d363458b93982f7e251dbbad7de3f145d1a3af43f72f3d00ba5226b889606e3fadf
-
Filesize
2.3MB
MD58691f040eccb2c4e0cf04af6520d6338
SHA12352f6b693f3c589a822b7061b681b888e8bfd17
SHA256dc3918812084ff39ae1e8a4f469ab37c861ea06fd6db5d7c704390a92231deb0
SHA512f6aaeb45622ad79cb2920954c50d7f5fcaf7e642b8c7373c3701c12960e04f593dc80957b6dfaad4110868f52ba5e110dcdd6b8a8860880b3cc276d9a6718acd
-
Filesize
8.9MB
MD555fb31632c70c5ddd3843bf1fabaf99f
SHA1f62ac0b1ee1278c190d433848ae082db98e905c6
SHA2569dc5deea1e262e516539e322c8bec5b3cd56158104dd4aed2431f55714a7ec52
SHA51240b025b98ba9f361ea2d8ea827e70329734320e1684c6f63f81ebc75220c3b6220b6491421a738bd4f6ddb12b2e99fa1e3bffb01cccc3a4f7b10fd415ab1454c