Analysis
-
max time kernel
161s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
submitted
26-07-2022 07:42
General
-
Target
SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
-
Size
888KB
-
MD5
1bcd34738e63d6e4c67d56a5ab8d3cd0
-
SHA1
8c8ee03272b9ec906ec060b39dd1b2ac0e820323
-
SHA256
20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e
-
SHA512
a095f1e9de182c0b6c01d6e7de354074b7df236dfe7ec568456b82252a675a3fe7e8a948e8c2b155b70a29f1a86b4e598ba8b2df83ed300345f0918c9b3b90c1
Malware Config
Extracted
warzonerat
51.195.145.82:5252
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlIWgaRWGWjiqw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlIWgaRWGWjiqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA930.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD532372bfda0f860418db86450740c7e98
SHA1ffea70f985c50f62b13071fab6cfb9c0fc9ab1d9
SHA2567ab340d93f3456b1fee684181de8c0ee7d85406ec67fa630e93b1c55401dc820
SHA512464a184c9a01fab9aaf014953af299b8cc4c56e96f2d398a7d9a0bab35ca39503dcd35227d125b13080ede5f8645be0126a663bea8635b62b7a6b91294eaae80
-
Filesize
1KB
MD55bbd1af9ade80dad3120943ad9792dfc
SHA147caad8f37f26e15df2d7627313e8cb4037bdff5
SHA256683b515da446ac70fafaed94b50706d5b808c8caada02eb0680efb97c852d123
SHA51260ace9137c7629ff2302a8683daba35a4314b80822808de52e4d73fb2debd50b9c9e7727773270d92291382239eb615fcbf3e175f9c4375d860302a1dac97f6e
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
-
-
Filesize
912KB
-
Filesize
408KB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
6.5MB
-
Filesize
600KB
-
Filesize
136KB
-
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
216KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
56KB
-
Filesize
200KB
-
Filesize
6.2MB
-
Filesize
120KB
-