Overview

overview

10

Static

static

3

WARN.zip

windows10-2004-x64

10

WARN.zip

windows11-21h2-x64

1

net8.0/AFo...ow.dll

windows10-2004-x64

1

net8.0/AFo...ow.dll

windows11-21h2-x64

1

net8.0/AFo...eo.dll

windows10-2004-x64

1

net8.0/AFo...eo.dll

windows11-21h2-x64

1

net8.0/AForge.dll

windows10-2004-x64

1

net8.0/AForge.dll

windows11-21h2-x64

1

net8.0/Dis...ds.dll

windows10-2004-x64

1

net8.0/Dis...ds.dll

windows11-21h2-x64

1

net8.0/Dis...re.dll

windows10-2004-x64

1

net8.0/Dis...re.dll

windows11-21h2-x64

1

net8.0/Dis...ve.dll

windows10-2004-x64

1

net8.0/Dis...ve.dll

windows11-21h2-x64

1

net8.0/Dis...ns.dll

windows10-2004-x64

1

net8.0/Dis...ns.dll

windows11-21h2-x64

1

net8.0/Dis...st.dll

windows10-2004-x64

1

net8.0/Dis...st.dll

windows11-21h2-x64

1

net8.0/Dis...et.dll

windows10-2004-x64

1

net8.0/Dis...et.dll

windows11-21h2-x64

1

net8.0/Dis...ok.dll

windows10-2004-x64

1

net8.0/Dis...ok.dll

windows11-21h2-x64

1

net8.0/Int...ry.dll

windows10-2004-x64

3

net8.0/Int...ry.dll

windows11-21h2-x64

3

net8.0/Mic...ns.dll

windows10-2004-x64

1

net8.0/Mic...ns.dll

windows11-21h2-x64

1

net8.0/Mic...ts.dll

windows10-2004-x64

1

net8.0/Mic...ts.dll

windows11-21h2-x64

1

net8.0/NAu...io.dll

windows10-2004-x64

1

net8.0/NAu...io.dll

windows11-21h2-x64

1

net8.0/NAu...re.dll

windows10-2004-x64

1

net8.0/NAu...re.dll

windows11-21h2-x64

1

Resubmissions

01/06/2026, 05:20

260601-f1f4eacx9s

01/06/2026, 04:58

260601-fl152aey2q10

Sharing

Copy URL Twitter E-mail

General

  • Target
    WARN.zip
  • Size 3.8MB
  • Sample260601-fl152aey2q
  • SHA256 6492ea0b128804ec765e0a860ee5f92a0ceee88280888dfe53fec80aca436e39
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      WARN.zip
    • Size 3.8MB
    • SHA256 6492ea0b128804ec765e0a860ee5f92a0ceee88280888dfe53fec80aca436e39
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

    • Modifies firewall policy service

      defense_evasion

    • Modifies security service

      defense_evasion

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

      persistence

    • Boot or Logon Autostart Execution: Print Processors

      Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

      persistence

    • Drops startup file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Modifies system executable filetype association

      persistence

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Modifies boot configuration data using bcdedit

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      net8.0/AForge.Video.DirectShow.dll
    • Size 60KB
    • SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      net8.0/AForge.Video.dll
    • Size 20KB
    • SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      net8.0/AForge.dll
    • Size 17KB
    • SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      net8.0/Discord.Net.Commands.dll
    • Size 135KB
    • SHA256 b8d1d3bb79eee6452f863accb592f7cad9e964704b50b62b27888cf781962b3d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      net8.0/Discord.Net.Core.dll
    • Size 927KB
    • SHA256 06a25d229d47bbb88056b832c53f52fdb8882510d4cfdf8e9b7132577a858033
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      net8.0/Discord.Net.Dave.dll
    • Size 30KB
    • SHA256 5a936554d259a16e566fe11a3316ce0f87f8ca1001b74c63068c39125f4a690e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      net8.0/Discord.Net.Interactions.dll
    • Size 282KB
    • SHA256 72c34d4ede80f6e05d0333697b822949d62e4f9a23472fc1aa03d7b736ea70f6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      net8.0/Discord.Net.Rest.dll
    • Size 1.5MB
    • SHA256 ab25e522499c6ad145ddb3a36a519f3363e08f2778e04be8d6177e077321d286
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      net8.0/Discord.Net.WebSocket.dll
    • Size 959KB
    • SHA256 7042ad20fd0a99561c4a389f4f29abd0c0d93ef05c7213a9a39a9beeeafac70d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      net8.0/Discord.Net.Webhook.dll
    • Size 31KB
    • SHA256 d4c8b72f3647bca6e79056d9909a7a4101fbf10cea042b90aa06ecba0be55b77
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      net8.0/Interop.IWshRuntimeLibrary.dll
    • Size 36KB
    • SHA256 3884afc4d3e1af4d1fbe8e1859b41ed69560db8fe4141501ccc4d16c8e254275
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      net8.0/Microsoft.Extensions.DependencyInjection.Abstractions.dll
    • Size 63KB
    • SHA256 afdcd6be4baf7c48e67b469d77560203e6660cff0e18f290da36c949d3a47acb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      net8.0/Microsoft.Win32.SystemEvents.dll
    • Size 25KB
    • SHA256 8a5afa02244e76f4e7f8b597f8e3ac6fe635bdee8288d98f7893c2aebe656aaf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      net8.0/NAudio.Asio.dll
    • Size 33KB
    • SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      net8.0/NAudio.Core.dll
    • Size 183KB
    • SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Port Monitors

1
T1547.010

Print Processors

1
T1547.012

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Port Monitors

1
T1547.010

Print Processors

1
T1547.012

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Safe Mode Boot

1
T1562.009

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware
Score
10/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10