Analysis
- max time kernel
91s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
10/10/2022, 06:41
General
- Target Purchase order Oct.22.exe
- Size 885KB
- Sample221010-hfr2aaaha7
- SHA256 0e16e5938bafefb147c1c68ed3c43336e45fcdce55c915c3c1db631c7a8b7e6a
Malware Config
Extracted
-
warzonerat
-
guest.maximos.quest:2626
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase order Oct.22.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order Oct.22.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Purchase order Oct.22.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OoydPxleZzy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OoydPxleZzy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp47B7.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase order Oct.22.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order Oct.22.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
tmp47B7.tmp
memory/2388-163-0x0000000007B80000-0x0000000007B88000-memory.dmp
memory/2388-159-0x0000000007AE0000-0x0000000007B76000-memory.dmp
memory/2388-139-0x0000000004FE0000-0x0000000005016000-memory.dmp
memory/2388-158-0x00000000078D0000-0x00000000078DA000-memory.dmp
memory/2388-162-0x0000000007BA0000-0x0000000007BBA000-memory.dmp
memory/2388-157-0x0000000007860000-0x000000000787A000-memory.dmp
memory/2388-151-0x0000000006540000-0x000000000655E000-memory.dmp
memory/2388-144-0x0000000005580000-0x00000000055A2000-memory.dmp
memory/2388-155-0x0000000071F20000-0x0000000071F6C000-memory.dmp
memory/2388-152-0x0000000007700000-0x0000000007732000-memory.dmp
memory/3164-149-0x0000000000400000-0x0000000000554000-memory.dmp
memory/3164-150-0x0000000000400000-0x0000000000554000-memory.dmp
memory/3164-166-0x0000000000400000-0x0000000000554000-memory.dmp
memory/3164-146-0x0000000000400000-0x0000000000554000-memory.dmp
memory/3164-160-0x0000000004200000-0x00000000043A0000-memory.dmp
memory/3876-142-0x0000000004EE0000-0x0000000005508000-memory.dmp
memory/3876-154-0x00000000060B0000-0x00000000060CE000-memory.dmp
memory/3876-156-0x00000000074E0000-0x0000000007B5A000-memory.dmp
memory/3876-153-0x0000000071F20000-0x0000000071F6C000-memory.dmp
memory/3876-161-0x00000000070D0000-0x00000000070DE000-memory.dmp
memory/3876-147-0x0000000004D60000-0x0000000004DC6000-memory.dmp
memory/5052-132-0x0000000000A00000-0x0000000000AE4000-memory.dmp
memory/5052-137-0x000000000A6F0000-0x000000000A756000-memory.dmp
memory/5052-136-0x000000000A3E0000-0x000000000A47C000-memory.dmp
memory/5052-135-0x0000000005510000-0x000000000551A000-memory.dmp
memory/5052-134-0x0000000005460000-0x00000000054F2000-memory.dmp
memory/5052-133-0x0000000005B10000-0x00000000060B4000-memory.dmp