Analysis
-
max time kernel
175s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 14:39
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.15216.14078.exe
-
Size
1.0MB
-
MD5
dbd404136dad8130e5b1197fcbf287d1
-
SHA1
225b6204a93d7512d8bac3d533aff6836b5c4d3e
-
SHA256
584f57edb1dc561be7396494ea26a3fe5c4c24fed1594636ce2167db8418abe1
-
SHA512
d1111093ea89fdd2df4282dcc5097c55e2e34b522259baa1fd1758f75da33a69919a8ecb5188136da2c837aff27bc40200cd3e450f224b72007ec43b85346a23
-
SSDEEP
24576:rz3lDgh/awtCPSJLir9KcCWY56PH62Dz:rz3lch/dsPFTkyHF
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15216.14078.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15216.14078.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zLxcgGKWkNnjkV.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zLxcgGKWkNnjkV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA747.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15216.14078.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15216.14078.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15216.14078.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15216.14078.exe"2⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD515b057c517babaa24e2870c52e4cd81f
SHA161fe1fddb33a86779b0689720a1ac72eb2d14514
SHA25604dcb84efc42e2dfe5f3f8372d5f8f9d316f9894dd91424ce16896280b8acddc
SHA5123bad70300a8fc58400a28924f79ae823cc1133a405dacaebb960cc49b2392c764ba7e151d8702858498cbbfdaf57856a5314fc1a449147ea690f3f3971ee0ed8
-
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
304KB
-
-
Filesize
104KB
-
Filesize
216KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
120KB
-
Filesize
200KB
-
Filesize
40KB
-
Filesize
6.5MB
-
Filesize
408KB
-
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
5.6MB
-
Filesize
1.1MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
624KB
-