warzonerat | a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
Size

8.2MB
MD5

6d0d046ecc6e30012184dc1113ab7b8e
SHA1

378874f5fe085f794da9c1dc4ff1c82f7703c118
SHA256

a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5
SHA512

1d9a0bf0ab1cfdd48f5d1c77e2a82e3092ac0bd4c5a34b72d2c4a424cfda50a8266b7ba058ed3dbfd465c9ff701d3712268e625f0f986b823c6cdfaa1062977b
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecg:V8e8e8f8e8e8j

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/files/0x0009000000016dd0-41.dat	warzonerat
behavioral1/memory/2876-44-0x00000000032B0000-0x00000000033C4000-memory.dmp	warzonerat
behavioral1/files/0x0008000000016da7-68.dat	warzonerat
behavioral1/files/0x0008000000016de8-88.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0009000000016dd0-41.dat	aspack_v212_v242
behavioral1/files/0x0008000000016da7-68.dat	aspack_v212_v242
behavioral1/files/0x0008000000016de8-88.dat	aspack_v212_v242

Executes dropped EXE 13 IoCs

pid	Process
2960	explorer.exe
1348	explorer.exe
2932	spoolsv.exe
3000	spoolsv.exe
3068	spoolsv.exe
1272	spoolsv.exe
2700	spoolsv.exe
1920	spoolsv.exe
2360	spoolsv.exe
2336	spoolsv.exe
2492	spoolsv.exe
2384	spoolsv.exe
2976	svchost.exe

Loads dropped DLL 64 IoCs

pid	Process
2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
1348	explorer.exe
1348	explorer.exe
1152	WerFault.exe
1152	WerFault.exe
1152	WerFault.exe
1152	WerFault.exe
1152	WerFault.exe
1152	WerFault.exe
1152	WerFault.exe
1348	explorer.exe
1348	explorer.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1348	explorer.exe
1348	explorer.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
1348	explorer.exe
1348	explorer.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1348	explorer.exe
1348	explorer.exe
2392	WerFault.exe
2392	WerFault.exe
2392	WerFault.exe
2392	WerFault.exe
2392	WerFault.exe
2392	WerFault.exe
2392	WerFault.exe
1348	explorer.exe
1348	explorer.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2960 set thread context of 1348	2960	explorer.exe	34
PID 2960 set thread context of 1424	2960	explorer.exe	35
PID 2932 set thread context of 2492	2932	spoolsv.exe	51
PID 2932 set thread context of 2792	2932	spoolsv.exe	52

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2292	3000	WerFault.exe	37
1152	3068	WerFault.exe	39
1660	1272	WerFault.exe	41
2508	2700	WerFault.exe	43
1740	1920	WerFault.exe	45
2392	2360	WerFault.exe	47
948	2336	WerFault.exe	49
2556	2384	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1348	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
1348	explorer.exe
2492	spoolsv.exe
2492	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 2876	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	31
PID 2348 wrote to memory of 3044	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2348 wrote to memory of 3044	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2348 wrote to memory of 3044	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2348 wrote to memory of 3044	2348	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	32
PID 2876 wrote to memory of 2960	2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	33
PID 2876 wrote to memory of 2960	2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	33
PID 2876 wrote to memory of 2960	2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	33
PID 2876 wrote to memory of 2960	2876	a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe	33
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1348	2960	explorer.exe	34
PID 2960 wrote to memory of 1424	2960	explorer.exe	35
PID 2960 wrote to memory of 1424	2960	explorer.exe	35
PID 2960 wrote to memory of 1424	2960	explorer.exe	35
PID 2960 wrote to memory of 1424	2960	explorer.exe	35
PID 2960 wrote to memory of 1424	2960	explorer.exe	35
PID 2960 wrote to memory of 1424	2960	explorer.exe	35
PID 1348 wrote to memory of 2932	1348	explorer.exe	36
PID 1348 wrote to memory of 2932	1348	explorer.exe	36
PID 1348 wrote to memory of 2932	1348	explorer.exe	36
PID 1348 wrote to memory of 2932	1348	explorer.exe	36
PID 1348 wrote to memory of 3000	1348	explorer.exe	37
PID 1348 wrote to memory of 3000	1348	explorer.exe	37
PID 1348 wrote to memory of 3000	1348	explorer.exe	37
PID 1348 wrote to memory of 3000	1348	explorer.exe	37
PID 3000 wrote to memory of 2292	3000	spoolsv.exe	38
PID 3000 wrote to memory of 2292	3000	spoolsv.exe	38
PID 3000 wrote to memory of 2292	3000	spoolsv.exe	38
PID 3000 wrote to memory of 2292	3000	spoolsv.exe	38
PID 1348 wrote to memory of 3068	1348	explorer.exe	39
PID 1348 wrote to memory of 3068	1348	explorer.exe	39
PID 1348 wrote to memory of 3068	1348	explorer.exe	39
PID 1348 wrote to memory of 3068	1348	explorer.exe	39
PID 3068 wrote to memory of 1152	3068	spoolsv.exe	40
PID 3068 wrote to memory of 1152	3068	spoolsv.exe	40
PID 3068 wrote to memory of 1152	3068	spoolsv.exe	40
PID 3068 wrote to memory of 1152	3068	spoolsv.exe	40
PID 1348 wrote to memory of 1272	1348	explorer.exe	41
PID 1348 wrote to memory of 1272	1348	explorer.exe	41
PID 1348 wrote to memory of 1272	1348	explorer.exe	41
PID 1348 wrote to memory of 1272	1348	explorer.exe	41
PID 1272 wrote to memory of 1660	1272	spoolsv.exe	42
PID 1272 wrote to memory of 1660	1272	spoolsv.exe	42
PID 1272 wrote to memory of 1660	1272	spoolsv.exe	42
PID 1272 wrote to memory of 1660	1272	spoolsv.exe	42
PID 1348 wrote to memory of 2700	1348	explorer.exe	43
PID 1348 wrote to memory of 2700	1348	explorer.exe	43
PID 1348 wrote to memory of 2700	1348	explorer.exe	43
PID 1348 wrote to memory of 2700	1348	explorer.exe	43

C:\Users\Admin\AppData\Local\Temp\a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
"C:\Users\Admin\AppData\Local\Temp\a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe
  "C:\Users\Admin\AppData\Local\Temp\a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2876
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2932
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2492
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2976
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2384
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 36
        6⤵
        Program crash
        
        PID:2556
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:1424
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.2MB

MD5
6d0d046ecc6e30012184dc1113ab7b8e

SHA1
378874f5fe085f794da9c1dc4ff1c82f7703c118

SHA256
a3bf0c7c25a30bba5a4d15fd131ce5482309ea8584cbf7287286503838eed1e5

SHA512
1d9a0bf0ab1cfdd48f5d1c77e2a82e3092ac0bd4c5a34b72d2c4a424cfda50a8266b7ba058ed3dbfd465c9ff701d3712268e625f0f986b823c6cdfaa1062977b

Download Submit
C:\Windows\system\explorer.exe

Filesize
8.2MB

MD5
a6f4ef214280c281525180b9e6fa3bbc

SHA1
a59e8bfb9ef4897373a4cc4293dc63a6b9c2966f

SHA256
c5314d05ccaa52a0fe842210a3069a76ac082e2fbc95021ddc4e68fff5687ea8

SHA512
722a1df9da3ffae30828b8a557be06041db07e3f9438dc5cd97452e95e96499e9db0282d96b931a7fc64c2dc71ad469607aba3d0bb066452a8fd0df570d80501

Download Submit
\Windows\system\spoolsv.exe

Filesize
8.2MB

MD5
6966e293f6496e7857d75ada6f0c4eda

SHA1
105752169c57c72e2f243479bba01d9b25b1ed0e

SHA256
ff2b56a71bb8a46f073979a1dc5fba7e27521654d79ddf09fd0aefba3c8d94d0

SHA512
7c1c663ee8f762590ae52b45d4e18804becda4ed42250310ba07c28297f1c9318012049cd3484b01493cae053019e138b4401ef31e7d2761e34c974088f265e2

Download Submit
memory/1348-141-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-228-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-229-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-166-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-145-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-253-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-139-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1348-128-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1348-109-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-254-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-94-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/1348-257-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1424-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1424-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1424-119-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1424-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1424-84-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1424-83-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2336-210-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2348-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2348-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2348-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2348-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2348-22-0x00000000032F0000-0x0000000003404000-memory.dmp

Filesize
1.1MB

Download
memory/2348-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2348-29-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2348-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2360-201-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2384-234-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2492-251-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2492-247-0x0000000003240000-0x0000000003354000-memory.dmp

Filesize
1.1MB

Download
memory/2876-44-0x00000000032B0000-0x00000000033C4000-memory.dmp

Filesize
1.1MB

Download
memory/2876-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-23-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2932-98-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2932-239-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2932-129-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2932-96-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2932-97-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2960-79-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2960-42-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2960-46-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2960-45-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2960-49-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2960-43-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2976-246-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2976-255-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3000-116-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3000-120-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3068-138-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download