Analysis

  • max time kernel
    140s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 12:03

General

  • Target

    Invoices,Pictures jpg jpg jpg jpg.exe

  • Size

    476KB

  • MD5

    bb5454dd5bd4348184f41b2a179fc485

  • SHA1

    fded32c568bf8bfbb4f937f6c6a23be3e4de8e3c

  • SHA256

    847a17631eb77cdb667aadc9bebec75562fd1dfc4fd6206d2ec2636a11671cca

  • SHA512

    af8b23f670510ee4539ccc14698005567cea83695e53e198a8041c3351d73787a1668221e4d4a0b7c5ee8ebd49cef67e0880c60b12d39b48f17074742f9c5be4

Malware Config

Extracted

Family

warzonerat

C2

198.12.84.39:5200

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs
  • Warzone RAT Payload 8 IoCs
  • Looks for VMWare Tools registry key 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoices,Pictures jpg jpg jpg jpg.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoices,Pictures jpg jpg jpg jpg.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eaKzFXHi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5477.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1496
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
        PID:1148

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp5477.tmp

      Filesize

      1KB

      MD5

      f489d8ad168cbc430fa4762c3038e6d3

      SHA1

      c2bbaf6b857eb35c3917794609dc931dccee6b67

      SHA256

      9a490668ac8d963f39c88180696402efc22c405e123a0170f4aae41139f2b6d3

      SHA512

      4a037b4a88ef63c23b1308b11938b314e48b9ec82bdee18fc5368ce2aecea9ba5737052eb042a1f091d5109021e96ec930eddbb0db7589c88c4110dbe5b72e48

    • memory/1148-70-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-69-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-64-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-76-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-67-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-75-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-61-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-66-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-71-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1148-72-0x0000000000405A3D-mapping.dmp

    • memory/1148-62-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1496-59-0x0000000000000000-mapping.dmp

    • memory/1628-54-0x0000000001390000-0x000000000140E000-memory.dmp

      Filesize

      504KB

    • memory/1628-56-0x0000000000410000-0x0000000000418000-memory.dmp

      Filesize

      32KB

    • memory/1628-57-0x0000000001300000-0x000000000135E000-memory.dmp

      Filesize

      376KB

    • memory/1628-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

      Filesize

      8KB

    • memory/1628-58-0x00000000011D0000-0x0000000001202000-memory.dmp

      Filesize

      200KB