warzonerat | a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/11/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
Size

8.2MB
MD5

6d0d046ecc6e30012184dc1113ab7b8e
SHA1

378874f5fe085f794da9c1dc4ff1c82f7703c118
SHA256

a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5
SHA512

1d9a0bf0ab1cfdd48f5d1c77e2a82e3092ac0bd4c5a34b72d2c4a424cfda50a8266b7ba058ed3dbfd465c9ff701d3712268e625f0f986b823c6cdfaa1062977b
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecg:V8e8e8f8e8e8j

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x000800000001920f-43.dat	warzonerat
behavioral1/files/0x0008000000018d68-82.dat	warzonerat
behavioral1/files/0x0007000000019234-96.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000800000001920f-43.dat	aspack_v212_v242
behavioral1/files/0x0008000000018d68-82.dat	aspack_v212_v242
behavioral1/files/0x0007000000019234-96.dat	aspack_v212_v242

Executes dropped EXE 13 IoCs

pid	Process
2708	explorer.exe
2812	explorer.exe
2232	spoolsv.exe
2228	spoolsv.exe
1108	spoolsv.exe
1868	spoolsv.exe
692	spoolsv.exe
2296	spoolsv.exe
1952	spoolsv.exe
1788	spoolsv.exe
2720	spoolsv.exe
2820	spoolsv.exe
2576	svchost.exe

Loads dropped DLL 64 IoCs

pid	Process
2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2396	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2812	explorer.exe
2812	explorer.exe
2976	WerFault.exe
2976	WerFault.exe
2976	WerFault.exe
2976	WerFault.exe
2976	WerFault.exe
2976	WerFault.exe
2976	WerFault.exe
2812	explorer.exe
2812	explorer.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2812	explorer.exe
2812	explorer.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2812	explorer.exe
2812	explorer.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe
2812	explorer.exe
2812	explorer.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2812	explorer.exe
2812	explorer.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 set thread context of 2856	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2708 set thread context of 2812	2708	explorer.exe	34
PID 2708 set thread context of 2900	2708	explorer.exe	35
PID 2232 set thread context of 2820	2232	spoolsv.exe	53
PID 2232 set thread context of 2836	2232	spoolsv.exe	54

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2396	2228	WerFault.exe
2976	1108	WerFault.exe	39
2460	1868	WerFault.exe
2968	692	WerFault.exe
896	2296	WerFault.exe
2320	1952	WerFault.exe	47
3052	1788	WerFault.exe	49
2796	2720	WerFault.exe	51

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2812	explorer.exe
2820	spoolsv.exe
2820	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2784	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2368 wrote to memory of 2856	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2368 wrote to memory of 2856	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2368 wrote to memory of 2856	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2368 wrote to memory of 2856	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2368 wrote to memory of 2856	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2368 wrote to memory of 2856	2368	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2784 wrote to memory of 2708	2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	33
PID 2784 wrote to memory of 2708	2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	33
PID 2784 wrote to memory of 2708	2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	33
PID 2784 wrote to memory of 2708	2784	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	33
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2812	2708	explorer.exe	34
PID 2708 wrote to memory of 2900	2708	explorer.exe	35
PID 2708 wrote to memory of 2900	2708	explorer.exe	35
PID 2708 wrote to memory of 2900	2708	explorer.exe	35
PID 2708 wrote to memory of 2900	2708	explorer.exe	35
PID 2708 wrote to memory of 2900	2708	explorer.exe	35
PID 2708 wrote to memory of 2900	2708	explorer.exe	35
PID 2812 wrote to memory of 2232	2812	explorer.exe	36
PID 2812 wrote to memory of 2232	2812	explorer.exe	36
PID 2812 wrote to memory of 2232	2812	explorer.exe	36
PID 2812 wrote to memory of 2232	2812	explorer.exe	36
PID 2812 wrote to memory of 2228	2812	explorer.exe	37
PID 2812 wrote to memory of 2228	2812	explorer.exe	37
PID 2812 wrote to memory of 2228	2812	explorer.exe	37
PID 2812 wrote to memory of 2228	2812	explorer.exe	37
PID 2228 wrote to memory of 2396	2228	spoolsv.exe	38
PID 2228 wrote to memory of 2396	2228	spoolsv.exe	38
PID 2228 wrote to memory of 2396	2228	spoolsv.exe	38
PID 2228 wrote to memory of 2396	2228	spoolsv.exe	38
PID 2812 wrote to memory of 1108	2812	explorer.exe	39
PID 2812 wrote to memory of 1108	2812	explorer.exe	39
PID 2812 wrote to memory of 1108	2812	explorer.exe	39
PID 2812 wrote to memory of 1108	2812	explorer.exe	39
PID 1108 wrote to memory of 2976	1108	spoolsv.exe	40
PID 1108 wrote to memory of 2976	1108	spoolsv.exe	40
PID 1108 wrote to memory of 2976	1108	spoolsv.exe	40
PID 1108 wrote to memory of 2976	1108	spoolsv.exe	40
PID 2812 wrote to memory of 1868	2812	explorer.exe	41
PID 2812 wrote to memory of 1868	2812	explorer.exe	41
PID 2812 wrote to memory of 1868	2812	explorer.exe	41
PID 2812 wrote to memory of 1868	2812	explorer.exe	41
PID 1868 wrote to memory of 2460	1868	spoolsv.exe	42
PID 1868 wrote to memory of 2460	1868	spoolsv.exe	42
PID 1868 wrote to memory of 2460	1868	spoolsv.exe	42
PID 1868 wrote to memory of 2460	1868	spoolsv.exe	42
PID 2812 wrote to memory of 692	2812	explorer.exe	43
PID 2812 wrote to memory of 692	2812	explorer.exe	43

C:\Users\Admin\AppData\Local\Temp\a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
"C:\Users\Admin\AppData\Local\Temp\a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
  "C:\Users\Admin\AppData\Local\Temp\a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2232
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2576
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:2836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2296
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 36
        6⤵
        Program crash
        
        PID:2796
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:2900
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.2MB

MD5
6d0d046ecc6e30012184dc1113ab7b8e

SHA1
378874f5fe085f794da9c1dc4ff1c82f7703c118

SHA256
a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5

SHA512
1d9a0bf0ab1cfdd48f5d1c77e2a82e3092ac0bd4c5a34b72d2c4a424cfda50a8266b7ba058ed3dbfd465c9ff701d3712268e625f0f986b823c6cdfaa1062977b

Download Submit
C:\Windows\system\explorer.exe

Filesize
8.2MB

MD5
ac5f43b1bfc9642c33bbb9c89ec3f1e6

SHA1
2be794b7b715740b609da86343931c9da4772fac

SHA256
35cd18e196ce7bb4d7a36af117feddc1840441ef776b71c6d4f08aef26ce90cb

SHA512
8dc2c2e2f2a9e2a7ab7d280552d35266613e7ace49bb41cc1b7f53269d076b07143f43b178ba44b025c35399591d2f1b15386921a33e80b061c23a892129409f

Download Submit
\Windows\system\spoolsv.exe

Filesize
8.2MB

MD5
2d6801f718a3d9b5dc5200824775c800

SHA1
bd75bac6e17c3dce1cccf20a7a5f3a43fd466827

SHA256
112b6ffca4e2638a4b800c6373b3aaf191124bc0d80b924764a37c6b69751c98

SHA512
29f61a81fe85bd05150eab756dabf6e9bc2e0d29e4710ebc839a420e736194ab752e1b1ed27a338493da5af934783a841adae8bc6b83d7de7646abdb4b1e7c92

Download Submit
memory/1108-134-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1868-156-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2228-117-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2228-125-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2232-144-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2232-254-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2232-104-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2232-105-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2296-196-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2368-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2368-22-0x00000000031F0000-0x0000000003304000-memory.dmp

Filesize
1.1MB

Download
memory/2368-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2368-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2368-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2368-40-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2368-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2368-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2576-271-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2708-53-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2708-54-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2708-56-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2708-55-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2708-93-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2708-60-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2784-51-0x00000000033E0000-0x00000000034F4000-memory.dmp

Filesize
1.1MB

Download
memory/2784-50-0x00000000033E0000-0x00000000034F4000-memory.dmp

Filesize
1.1MB

Download
memory/2784-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-23-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2812-155-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-176-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-135-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-103-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2812-273-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2812-145-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-146-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-269-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-157-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-268-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-167-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-177-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-116-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-195-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-228-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-213-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-211-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2812-222-0x00000000033D0000-0x00000000034E4000-memory.dmp

Filesize
1.1MB

Download
memory/2820-246-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2820-262-0x0000000003150000-0x0000000003264000-memory.dmp

Filesize
1.1MB

Download
memory/2820-267-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2856-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2856-33-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-36-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-38-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-29-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2900-85-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download