warzonerat | 8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
09/12/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
Size

8.2MB
MD5

57752e84411dd13aa79cf7cfa457f02c
SHA1

3c772396f7366420ac696ab48d28a87af7967e9e
SHA256

8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587
SHA512

46f69220193091e98f8661a66d920acbee7292bf56fff578a4c306ce742b5bcb50cbf65b72ca6476db347ef4739026d202eecd37a11188ef89b587bb60f595e0
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecM:V8e8e8f8e8e87

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x0008000000016cd7-41.dat	warzonerat
behavioral1/files/0x0008000000016c66-78.dat	warzonerat
behavioral1/files/0x0008000000016cf5-92.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000016cd7-41.dat	aspack_v212_v242
behavioral1/files/0x0008000000016c66-78.dat	aspack_v212_v242
behavioral1/files/0x0008000000016cf5-92.dat	aspack_v212_v242

Executes dropped EXE 13 IoCs

pid	Process
2676	explorer.exe
1824	explorer.exe
1796	spoolsv.exe
2708	spoolsv.exe
1628	spoolsv.exe
1364	spoolsv.exe
880	spoolsv.exe
2452	spoolsv.exe
1612	spoolsv.exe
2588	spoolsv.exe
2836	spoolsv.exe
2800	spoolsv.exe
2356	svchost.exe

Loads dropped DLL 64 IoCs

pid	Process
348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
1824	explorer.exe
1824	explorer.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1824	explorer.exe
1824	explorer.exe
2044	WerFault.exe
2044	WerFault.exe
2044	WerFault.exe
2044	WerFault.exe
2044	WerFault.exe
2044	WerFault.exe
2044	WerFault.exe
1824	explorer.exe
1824	explorer.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
3020	WerFault.exe
1824	explorer.exe
1824	explorer.exe
1544	WerFault.exe
1544	WerFault.exe
1544	WerFault.exe
1544	WerFault.exe
1544	WerFault.exe
1544	WerFault.exe
1544	WerFault.exe
1824	explorer.exe
1824	explorer.exe
1920	WerFault.exe
1920	WerFault.exe
1920	WerFault.exe
1920	WerFault.exe
1920	WerFault.exe
1920	WerFault.exe
1920	WerFault.exe
1824	explorer.exe
1824	explorer.exe
1580	WerFault.exe
1580	WerFault.exe
1580	WerFault.exe
1580	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 set thread context of 2808	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	32
PID 2676 set thread context of 1824	2676	explorer.exe	34
PID 2676 set thread context of 2316	2676	explorer.exe	35
PID 1796 set thread context of 2800	1796	spoolsv.exe	53
PID 1796 set thread context of 2900	1796	spoolsv.exe	54

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2056	2708	WerFault.exe	37
1800	1628	WerFault.exe
2044	1364	WerFault.exe
3020	880	WerFault.exe
1544	2452	WerFault.exe
1920	1612	WerFault.exe
1580	2588	WerFault.exe	49
528	2836	WerFault.exe	51

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1824	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
2800	spoolsv.exe
2800	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 348	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	31
PID 2092 wrote to memory of 2808	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	32
PID 2092 wrote to memory of 2808	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	32
PID 2092 wrote to memory of 2808	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	32
PID 2092 wrote to memory of 2808	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	32
PID 2092 wrote to memory of 2808	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	32
PID 2092 wrote to memory of 2808	2092	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	32
PID 348 wrote to memory of 2676	348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	33
PID 348 wrote to memory of 2676	348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	33
PID 348 wrote to memory of 2676	348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	33
PID 348 wrote to memory of 2676	348	8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe	33
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 1824	2676	explorer.exe	34
PID 2676 wrote to memory of 2316	2676	explorer.exe	35
PID 2676 wrote to memory of 2316	2676	explorer.exe	35
PID 2676 wrote to memory of 2316	2676	explorer.exe	35
PID 2676 wrote to memory of 2316	2676	explorer.exe	35
PID 2676 wrote to memory of 2316	2676	explorer.exe	35
PID 2676 wrote to memory of 2316	2676	explorer.exe	35
PID 1824 wrote to memory of 1796	1824	explorer.exe	36
PID 1824 wrote to memory of 1796	1824	explorer.exe	36
PID 1824 wrote to memory of 1796	1824	explorer.exe	36
PID 1824 wrote to memory of 1796	1824	explorer.exe	36
PID 1824 wrote to memory of 2708	1824	explorer.exe	37
PID 1824 wrote to memory of 2708	1824	explorer.exe	37
PID 1824 wrote to memory of 2708	1824	explorer.exe	37
PID 1824 wrote to memory of 2708	1824	explorer.exe	37
PID 2708 wrote to memory of 2056	2708	spoolsv.exe	38
PID 2708 wrote to memory of 2056	2708	spoolsv.exe	38
PID 2708 wrote to memory of 2056	2708	spoolsv.exe	38
PID 2708 wrote to memory of 2056	2708	spoolsv.exe	38
PID 1824 wrote to memory of 1628	1824	explorer.exe	39
PID 1824 wrote to memory of 1628	1824	explorer.exe	39
PID 1824 wrote to memory of 1628	1824	explorer.exe	39
PID 1824 wrote to memory of 1628	1824	explorer.exe	39
PID 1628 wrote to memory of 1800	1628	spoolsv.exe	40
PID 1628 wrote to memory of 1800	1628	spoolsv.exe	40
PID 1628 wrote to memory of 1800	1628	spoolsv.exe	40
PID 1628 wrote to memory of 1800	1628	spoolsv.exe	40
PID 1824 wrote to memory of 1364	1824	explorer.exe	41
PID 1824 wrote to memory of 1364	1824	explorer.exe	41
PID 1824 wrote to memory of 1364	1824	explorer.exe	41
PID 1824 wrote to memory of 1364	1824	explorer.exe	41
PID 1364 wrote to memory of 2044	1364	spoolsv.exe	42
PID 1364 wrote to memory of 2044	1364	spoolsv.exe	42
PID 1364 wrote to memory of 2044	1364	spoolsv.exe	42
PID 1364 wrote to memory of 2044	1364	spoolsv.exe	42
PID 1824 wrote to memory of 880	1824	explorer.exe	43
PID 1824 wrote to memory of 880	1824	explorer.exe	43

C:\Users\Admin\AppData\Local\Temp\8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
"C:\Users\Admin\AppData\Local\Temp\8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe
  "C:\Users\Admin\AppData\Local\Temp\8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:348
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1796
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:2900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:3020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 36
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 36
        6⤵
        Program crash
        
        PID:528
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:2316
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.2MB

MD5
57752e84411dd13aa79cf7cfa457f02c

SHA1
3c772396f7366420ac696ab48d28a87af7967e9e

SHA256
8fea0cc1e0acaca0170cac3bd98d40c3d8db52188bd757053fe798fc0cb2d587

SHA512
46f69220193091e98f8661a66d920acbee7292bf56fff578a4c306ce742b5bcb50cbf65b72ca6476db347ef4739026d202eecd37a11188ef89b587bb60f595e0

Download Submit
C:\Windows\system\explorer.exe

Filesize
8.2MB

MD5
05bf57cfd992cddb3da7a5b3bd188a51

SHA1
3b4251d40e4c9a98297d16c8765b408fef7e5b49

SHA256
3480ea02959ff5c3f89512f5e2e6ee4f8331e34ae1a170fe48c6fd05937eec38

SHA512
a018d3290c7ec4b3105f9956fa11b0077f12534d94ae4345786bd8d0ba817e9ed0bea3bf75c87fa9b2ba7449fc99e782b8a4a6852bb39aa4d425ca61901942ee

Download Submit
\Windows\system\spoolsv.exe

Filesize
8.2MB

MD5
49d148e2051420006f6e3c65e5d12a29

SHA1
a56a54877cb376858cbe90a2e7080fa5349fd30d

SHA256
3fab92c48238a8325033dc94c7679e32c15dd11f1a259ee8aa83fa7956dc38ca

SHA512
053901501dae9ca9f8f9e623aa298d3c432960a7841c1d14bc03cf6593e7d6acda5cf3cb5b3623abbcc58a2497d984b92f80e2b38bc2dd70c958884004c8c6ab

Download Submit
memory/348-48-0x0000000003300000-0x0000000003414000-memory.dmp

Filesize
1.1MB

Download
memory/348-49-0x0000000003300000-0x0000000003414000-memory.dmp

Filesize
1.1MB

Download
memory/348-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/348-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/348-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/348-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/348-22-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/348-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/880-171-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1364-153-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1612-209-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1796-100-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1796-101-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1796-139-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1796-249-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1824-154-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-111-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-265-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1824-199-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-198-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-181-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-179-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-162-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-152-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-142-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1824-141-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-99-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-140-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-131-0x00000000031B0000-0x00000000032C4000-memory.dmp

Filesize
1.1MB

Download
memory/1824-121-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2092-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2092-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2092-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2092-36-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2092-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2092-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2092-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2356-256-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2356-264-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2676-89-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2676-51-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2676-57-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2676-53-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2676-52-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2676-54-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2708-122-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2708-113-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2800-240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2800-261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-37-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2808-27-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2808-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2808-31-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2808-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2836-224-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download