Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:01
General
-
Target
?? GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr
-
Size
705KB
-
MD5
1aeaa3d7660586286f1de3a8cf42b6a7
-
SHA1
af967f241edf3c1d966e6770e9721049b5c3d58f
-
SHA256
074a27ca162b894fea8bd9446e45b40e5342a07024589f3ad28e873d7fd9d8c8
-
SHA512
32fcc1af5b95df3f8e32109e0b7924db8527cb455e6a77b317bcb34ecdf5e429c9a42b0fdf231c6d16f7cdca6e673e69f2a9988a1fb4e21b6907612813c7daa1
Score
10/10
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\__ GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr"C:\Users\Admin\AppData\Local\Temp\__ GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\__ GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr"C:\Users\Admin\AppData\Local\Temp\__ GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr" /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-54-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/948-56-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1724-55-0x0000000000405907-mapping.dmp
-
memory/1956-58-0x0000000000000000-mapping.dmp
-
memory/1956-59-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB