warzonerat | 17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07

Analysis

max time kernel
97s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
Size

2.9MB
MD5

250a4ca15e86eec73c2960c718b395a0
SHA1

455df2cf1a7bee9077773f15ae0f6729db09f8bc
SHA256

17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07
SHA512

572de7269df775ff665baad03477d6d6c71de2e00c7640c38d5309558f4147a19a3e3d96361cbc1a263918ac20a15097f78fb8bcf20d2ee6ae050f892612a852
SSDEEP

24576:eTy7ASmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHR:eTy7ASmw4gxeOw46fUbNecCCFbNecy

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/files/0x000b0000000170f8-93.dat	warzonerat
behavioral1/files/0x0007000000016fc9-169.dat	warzonerat
behavioral1/files/0x0003000000018334-184.dat	warzonerat
behavioral1/files/0x0003000000018334-502.dat	warzonerat
behavioral1/files/0x0003000000018334-550.dat	warzonerat
behavioral1/files/0x0003000000018334-549.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
1120	explorer.exe
1632	explorer.exe
1516	explorer.exe
2576	spoolsv.exe
2420	spoolsv.exe
2848	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
1516	explorer.exe
1516	explorer.exe
2576	spoolsv.exe
1516	explorer.exe
1516	explorer.exe
2848	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2060 set thread context of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 set thread context of 2968	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	34
PID 1120 set thread context of 1632	1120	explorer.exe	38
PID 1632 set thread context of 1516	1632	explorer.exe	40
PID 1632 set thread context of 1760	1632	explorer.exe	41
PID 2576 set thread context of 2420	2576	spoolsv.exe	45

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
1120	explorer.exe
2576	spoolsv.exe
1516	explorer.exe
1516	explorer.exe
2848	spoolsv.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
1120	explorer.exe
1120	explorer.exe
1516	explorer.exe
1516	explorer.exe
2576	spoolsv.exe
2576	spoolsv.exe
1516	explorer.exe
1516	explorer.exe
2848	spoolsv.exe
2848	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2892	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	30
PID 2860 wrote to memory of 2892	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	30
PID 2860 wrote to memory of 2892	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	30
PID 2860 wrote to memory of 2892	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	30
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2860 wrote to memory of 2060	2860	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	32
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2908	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	33
PID 2060 wrote to memory of 2968	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	34
PID 2060 wrote to memory of 2968	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	34
PID 2060 wrote to memory of 2968	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	34
PID 2060 wrote to memory of 2968	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	34
PID 2060 wrote to memory of 2968	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	34
PID 2060 wrote to memory of 2968	2060	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	34
PID 2908 wrote to memory of 1120	2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	35
PID 2908 wrote to memory of 1120	2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	35
PID 2908 wrote to memory of 1120	2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	35
PID 2908 wrote to memory of 1120	2908	17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe	35
PID 1120 wrote to memory of 2992	1120	explorer.exe	36
PID 1120 wrote to memory of 2992	1120	explorer.exe	36
PID 1120 wrote to memory of 2992	1120	explorer.exe	36
PID 1120 wrote to memory of 2992	1120	explorer.exe	36
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38
PID 1120 wrote to memory of 1632	1120	explorer.exe	38

C:\Users\Admin\AppData\Local\Temp\17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
"C:\Users\Admin\AppData\Local\Temp\17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
  C:\Users\Admin\AppData\Local\Temp\17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
    C:\Users\Admin\AppData\Local\Temp\17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07N.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1120
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2992
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1632
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1884
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2860
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2644
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2220
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2768
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:544
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2032
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:368
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2464
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1592
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2540
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1656
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1696
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2284
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1580
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1760
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
250a4ca15e86eec73c2960c718b395a0

SHA1
455df2cf1a7bee9077773f15ae0f6729db09f8bc

SHA256
17f72cef60c40492ad8f86a4f4aedb05a8f7384a6364bdb20bba6f9c124dae07

SHA512
572de7269df775ff665baad03477d6d6c71de2e00c7640c38d5309558f4147a19a3e3d96361cbc1a263918ac20a15097f78fb8bcf20d2ee6ae050f892612a852

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
1.3MB

MD5
b597a67f25072e8e54828cadce4defaf

SHA1
96bdf15bb86d1c4baccfa11cb50ac928a5c267a2

SHA256
0857a5c67164932f55265cde15b2f1c4595fb715d9079f54af679e35fedf69f8

SHA512
411d7650e0f4d69e8e5aed737f15af215035477db5de428906d16887388c7b89092a2a21c10ee12cfba9f2f09251cc16e4be9a61f63463e019946cb078046447

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
1.2MB

MD5
4dd4a843d4a3f3680a6ff326cbe99c94

SHA1
3dfda1a53b196e4d0959c389a9cc3f5bde611a5d

SHA256
42692bc7d4bc00d2cbe628b27fd63386a4130e12e5a65ff9ea8dc823c97cfe42

SHA512
968955ac0e3fe86db84786c7039fa6d2ff3ad0e6798943abbb20706edcb34901e12efc473bff4622b72905bf241740fa403394580d6793b5bae262cb3bd90a1b

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
1.8MB

MD5
ccb2af89215c894a0d4e7f7ac69615c3

SHA1
927fbeaa5cedb3eadcb8ea77a24f457fec6bcf04

SHA256
d1f494970bc0b03785de71f32b013f68f33434de30fe445a0b0f6033fa188589

SHA512
3a6e5189b452efc7a2f7a71ff6efe645c98a106eabe99a9fe03943e0a38d3f66c1375f834de2fdc1e859991d0298a77dffb5af65ca420fa3c039e7661b0453b5

Download Submit
\Windows\system\explorer.exe

Filesize
2.9MB

MD5
da5a80d9c55989fb3f39887a6077d2f2

SHA1
f1b3036e2bc538729140fa23b8d5448f71509a0e

SHA256
99d5360c8c1ed6bf65642210b62fbc4241dc8725089cf2d30a652c0cb7f508b1

SHA512
3d25c2f0094a5ff800d43b1620bbca9e6155bf9815ba6363401dff324056027e0d3d45d22bda1cf8cc47e443b4dbafe98d5a8dce93feb32af6b33bfcd7faee74

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
405293bbbefeb46a623ff03d72e355fb

SHA1
bac17b6b7ec8c01039e7661e8f93b4d34891097d

SHA256
41c7c53ff97dfdba75969526f2b927d5a21f5527d1d96db09ba9f39a8b979440

SHA512
7c3f54c4e35a3cbbf078816f2eedc5c6fecc93c3edd100bdc5e0604fe5dd8372d23f74ec011677ea519dd2d2ad2df2df6473107bd54c2b74a6c5269086c63c8e

Download Submit
\Windows\system\spoolsv.exe

Filesize
1.4MB

MD5
26780d78a2de063a4ee5a199f75c5d28

SHA1
c2b503ac57f080804f7067d091d057aa7cda10e5

SHA256
9233ffd0494eda178ad3634b4831a4830969374d4df9b357884b3b148719daad

SHA512
76e0f94bfc40e976a4878aace631a4bd5215754de98cf09087fe2dc16c8211098a715990e2e993d6be9ac63ef935e629852a0a8435e856bfe312ecf43b2ec4cc

Download Submit
\Windows\system\spoolsv.exe

Filesize
1.9MB

MD5
bfa6adee1424e820070d6f2565f7245b

SHA1
0b077ef028471a0e5746062025ef93d6db774f12

SHA256
13406e58c462020584f9e3c5b4cda81a12329c5af965a1fbc7a06353b134c3f3

SHA512
d3a3e1f01d0f5aa99d0c0f08c6cb15748865a6081a3f5f164872c8fe8ca0a6e9a260f5f324b1c3c7b7a4282ef910082841a237f84b3f29d1171179034d4ebf9e

Download Submit
\Windows\system\spoolsv.exe

Filesize
256KB

MD5
9ecb95035ab04999f1292f9f68ba5a33

SHA1
47d260d3f3b55c9724350a493a191ea22fd31ba3

SHA256
7dc70162ab06678e9ec40729f0c447e8b6fb78dbdb379cabfa307d541be683bb

SHA512
c8ec08a4ab308e73efcfd279c98d335cd9e9860bd67a3d3127643724620b231580c494bcf40842f69248852ea9a7a7a06a53f7a0cc2ee88fc536fd115a38d894

Download Submit
memory/1632-178-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1632-149-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2032-394-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2060-28-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-51-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-21-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-15-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-42-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-40-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-38-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-36-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-31-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2060-29-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-26-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-23-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-20-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-17-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-5-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-46-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-54-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2060-53-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-13-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-10-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-8-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-43-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-41-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-87-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-52-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-47-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-48-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2060-12-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-45-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-50-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-49-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2060-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2420-237-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2464-442-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2540-501-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2644-295-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2768-352-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2908-143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-62-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-66-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-73-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-58-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-60-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2968-86-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download