Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23-06-2022 05:56
Static task
static1
Behavioral task
behavioral1
Sample
Details.pdf.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Details.pdf.js
Resource
win10v2004-20220414-en
General
-
Target
Details.pdf.js
-
Size
562KB
-
MD5
cb59237d6204d65a220eac88ad0af4e5
-
SHA1
64304835929c67739b2aba280dcd0f9761925440
-
SHA256
880764b02a05b427918594f017fa9c1fa3e9e8255506d542c302eb93380b0be8
-
SHA512
ccd966e2c4e9715d0e46fe4e3c9f331c591757ffe184deaec93797271a77c12d86ad5e00d1b90fc4aa829a38016e3b38344bc711556c8026a0397f9d66bcea9a
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Anew.exe warzonerat C:\Users\Admin\AppData\Roaming\Anew.exe warzonerat C:\Users\Admin\Documents\images.exe warzonerat C:\Users\Admin\Documents\images.exe warzonerat -
Blocklisted process makes network request 17 IoCs
Processes:
wscript.exeflow pid process 6 5048 wscript.exe 15 5048 wscript.exe 25 5048 wscript.exe 32 5048 wscript.exe 36 5048 wscript.exe 41 5048 wscript.exe 47 5048 wscript.exe 50 5048 wscript.exe 52 5048 wscript.exe 56 5048 wscript.exe 60 5048 wscript.exe 62 5048 wscript.exe 65 5048 wscript.exe 68 5048 wscript.exe 70 5048 wscript.exe 73 5048 wscript.exe 75 5048 wscript.exe -
Executes dropped EXE 2 IoCs
Processes:
Anew.exeimages.exepid process 4568 Anew.exe 3596 images.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\duRKcJnxZP.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\duRKcJnxZP.js wscript.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
wscript.exeAnew.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\duRKcJnxZP.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images.exe = "C:\\Users\\Admin\\Documents\\images.exe" Anew.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 4228 powershell.exe 4228 powershell.exe 224 powershell.exe 224 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4228 powershell.exe Token: SeDebugPrivilege 224 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
wscript.exeAnew.exeimages.exedescription pid process target process PID 4932 wrote to memory of 5048 4932 wscript.exe wscript.exe PID 4932 wrote to memory of 5048 4932 wscript.exe wscript.exe PID 4932 wrote to memory of 4568 4932 wscript.exe Anew.exe PID 4932 wrote to memory of 4568 4932 wscript.exe Anew.exe PID 4932 wrote to memory of 4568 4932 wscript.exe Anew.exe PID 4568 wrote to memory of 4228 4568 Anew.exe powershell.exe PID 4568 wrote to memory of 4228 4568 Anew.exe powershell.exe PID 4568 wrote to memory of 4228 4568 Anew.exe powershell.exe PID 4568 wrote to memory of 3596 4568 Anew.exe images.exe PID 4568 wrote to memory of 3596 4568 Anew.exe images.exe PID 4568 wrote to memory of 3596 4568 Anew.exe images.exe PID 3596 wrote to memory of 224 3596 images.exe powershell.exe PID 3596 wrote to memory of 224 3596 images.exe powershell.exe PID 3596 wrote to memory of 224 3596 images.exe powershell.exe PID 3596 wrote to memory of 4780 3596 images.exe cmd.exe PID 3596 wrote to memory of 4780 3596 images.exe cmd.exe PID 3596 wrote to memory of 4780 3596 images.exe cmd.exe PID 3596 wrote to memory of 4780 3596 images.exe cmd.exe PID 3596 wrote to memory of 4780 3596 images.exe cmd.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Details.pdf.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\duRKcJnxZP.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Anew.exe"C:\Users\Admin\AppData\Roaming\Anew.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5b07cba4e3adc3da35da678a89a8966fe
SHA19b3002202018aca6079f72cece82e9c91dc50d7b
SHA25690088fd879456cee47d4e9f9c59cf53f1883344be062d52e09c41d0b4cef80e3
SHA512e220ccf89692f43d6c09da7aebe88343e45ddd62d9f8848642b9944e029229bb95f848078bd127fb8bb068f0c5a379f18bd05671714c342be9477875a1ff982b
-
C:\Users\Admin\AppData\Roaming\Anew.exeFilesize
131KB
MD5db85d99c2bd8a7d6b1a6e4fdda9dedc7
SHA102561516bf81162120b3d1a741e232cf6962173b
SHA256898f47d683968d318db92b19c683452a39e1ccdfd9a0e07a516e6354220d67b1
SHA512ee957f8c344f2efd1d64551ea366bb357cbeb91e5f9c1a154f297e861cd8cefae892813b7c222d04fbd7c9b5ce357b1e3bff54663465c2b5fefad0ecf04c46bf
-
C:\Users\Admin\AppData\Roaming\Anew.exeFilesize
131KB
MD5db85d99c2bd8a7d6b1a6e4fdda9dedc7
SHA102561516bf81162120b3d1a741e232cf6962173b
SHA256898f47d683968d318db92b19c683452a39e1ccdfd9a0e07a516e6354220d67b1
SHA512ee957f8c344f2efd1d64551ea366bb357cbeb91e5f9c1a154f297e861cd8cefae892813b7c222d04fbd7c9b5ce357b1e3bff54663465c2b5fefad0ecf04c46bf
-
C:\Users\Admin\AppData\Roaming\duRKcJnxZP.jsFilesize
117KB
MD52ceda72d46215115db2fd420d1b2b572
SHA1aa5df32f61fef685e1ba28715c68a60f54b27de7
SHA2561a01f5780fe39194f89c220a0e899f028478c9312977d176b3c9e2db544b6e96
SHA512924e847d376e2c33dfe7e14ab7120a63264396c2cd293a7c20b4df864fb3a170c7fe7abc42bfecce89cb1ce0c42709a91ec0cf76ddf8707088a6c1278544f055
-
C:\Users\Admin\Documents\images.exeFilesize
131KB
MD5db85d99c2bd8a7d6b1a6e4fdda9dedc7
SHA102561516bf81162120b3d1a741e232cf6962173b
SHA256898f47d683968d318db92b19c683452a39e1ccdfd9a0e07a516e6354220d67b1
SHA512ee957f8c344f2efd1d64551ea366bb357cbeb91e5f9c1a154f297e861cd8cefae892813b7c222d04fbd7c9b5ce357b1e3bff54663465c2b5fefad0ecf04c46bf
-
C:\Users\Admin\Documents\images.exeFilesize
131KB
MD5db85d99c2bd8a7d6b1a6e4fdda9dedc7
SHA102561516bf81162120b3d1a741e232cf6962173b
SHA256898f47d683968d318db92b19c683452a39e1ccdfd9a0e07a516e6354220d67b1
SHA512ee957f8c344f2efd1d64551ea366bb357cbeb91e5f9c1a154f297e861cd8cefae892813b7c222d04fbd7c9b5ce357b1e3bff54663465c2b5fefad0ecf04c46bf
-
memory/224-154-0x000000006FC10000-0x000000006FC5C000-memory.dmpFilesize
304KB
-
memory/224-145-0x0000000000000000-mapping.dmp
-
memory/3596-142-0x0000000000000000-mapping.dmp
-
memory/4228-137-0x0000000005560000-0x0000000005B88000-memory.dmpFilesize
6.2MB
-
memory/4228-151-0x0000000007610000-0x000000000761A000-memory.dmpFilesize
40KB
-
memory/4228-140-0x0000000005C70000-0x0000000005CD6000-memory.dmpFilesize
408KB
-
memory/4228-139-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/4228-138-0x00000000053D0000-0x00000000053F2000-memory.dmpFilesize
136KB
-
memory/4228-135-0x0000000000000000-mapping.dmp
-
memory/4228-146-0x0000000007240000-0x0000000007272000-memory.dmpFilesize
200KB
-
memory/4228-147-0x000000006FC10000-0x000000006FC5C000-memory.dmpFilesize
304KB
-
memory/4228-148-0x0000000006840000-0x000000000685E000-memory.dmpFilesize
120KB
-
memory/4228-149-0x0000000007BE0000-0x000000000825A000-memory.dmpFilesize
6.5MB
-
memory/4228-150-0x0000000007590000-0x00000000075AA000-memory.dmpFilesize
104KB
-
memory/4228-141-0x0000000006280000-0x000000000629E000-memory.dmpFilesize
120KB
-
memory/4228-152-0x0000000007810000-0x00000000078A6000-memory.dmpFilesize
600KB
-
memory/4228-153-0x00000000077C0000-0x00000000077CE000-memory.dmpFilesize
56KB
-
memory/4228-136-0x0000000002950000-0x0000000002986000-memory.dmpFilesize
216KB
-
memory/4228-155-0x00000000078D0000-0x00000000078EA000-memory.dmpFilesize
104KB
-
memory/4228-156-0x00000000078B0000-0x00000000078B8000-memory.dmpFilesize
32KB
-
memory/4568-132-0x0000000000000000-mapping.dmp
-
memory/4780-157-0x0000000000000000-mapping.dmp
-
memory/4780-160-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/5048-130-0x0000000000000000-mapping.dmp