Analysis
-
max time kernel
134s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 21:02
Static task
static1
Behavioral task
behavioral1
Sample
origin.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
origin.exe
Resource
win10v2004-20220812-en
General
-
Target
origin.exe
-
Size
552KB
-
MD5
fd49a17b3d4bfe10a79a8f6c25f72f50
-
SHA1
a25885590c16d80d46846d75f1f7646bfc26c005
-
SHA256
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
-
SHA512
3049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
SSDEEP
12288:GPqfpmguB1C6MgG4WymunsifuHqDoCu9l9jq:IqfpmguvC6zG46u+HqDoL9j
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/268-69-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/268-70-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/268-74-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/268-75-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/268-76-0x000000000040B556-mapping.dmp warzonerat behavioral1/memory/268-72-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/268-79-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/268-82-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/268-87-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat -
Executes dropped EXE 6 IoCs
Processes:
internetexploer.exeinternetexploer.exeinternetexploer.exeinternetexploer.exeinternetexploer.exeinternetexploer.exepid process 1652 internetexploer.exe 1972 internetexploer.exe 1392 internetexploer.exe 1724 internetexploer.exe 884 internetexploer.exe 2000 internetexploer.exe -
Loads dropped DLL 1 IoCs
Processes:
origin.exepid process 268 origin.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
origin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\internetexploer.exe = "C:\\Users\\Admin\\Documents\\internetexploer.exe" origin.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
origin.exedescription pid process target process PID 1680 set thread context of 268 1680 origin.exe origin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exeinternetexploer.exepowershell.exepid process 1712 powershell.exe 1652 internetexploer.exe 1652 internetexploer.exe 1652 internetexploer.exe 1652 internetexploer.exe 1652 internetexploer.exe 1652 internetexploer.exe 1652 internetexploer.exe 1128 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeinternetexploer.exepowershell.exedescription pid process Token: SeDebugPrivilege 1712 powershell.exe Token: SeDebugPrivilege 1652 internetexploer.exe Token: SeDebugPrivilege 1128 powershell.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
origin.exeorigin.exeinternetexploer.exedescription pid process target process PID 1680 wrote to memory of 1712 1680 origin.exe powershell.exe PID 1680 wrote to memory of 1712 1680 origin.exe powershell.exe PID 1680 wrote to memory of 1712 1680 origin.exe powershell.exe PID 1680 wrote to memory of 1712 1680 origin.exe powershell.exe PID 1680 wrote to memory of 1204 1680 origin.exe schtasks.exe PID 1680 wrote to memory of 1204 1680 origin.exe schtasks.exe PID 1680 wrote to memory of 1204 1680 origin.exe schtasks.exe PID 1680 wrote to memory of 1204 1680 origin.exe schtasks.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 1680 wrote to memory of 268 1680 origin.exe origin.exe PID 268 wrote to memory of 1652 268 origin.exe internetexploer.exe PID 268 wrote to memory of 1652 268 origin.exe internetexploer.exe PID 268 wrote to memory of 1652 268 origin.exe internetexploer.exe PID 268 wrote to memory of 1652 268 origin.exe internetexploer.exe PID 1652 wrote to memory of 1128 1652 internetexploer.exe powershell.exe PID 1652 wrote to memory of 1128 1652 internetexploer.exe powershell.exe PID 1652 wrote to memory of 1128 1652 internetexploer.exe powershell.exe PID 1652 wrote to memory of 1128 1652 internetexploer.exe powershell.exe PID 1652 wrote to memory of 772 1652 internetexploer.exe schtasks.exe PID 1652 wrote to memory of 772 1652 internetexploer.exe schtasks.exe PID 1652 wrote to memory of 772 1652 internetexploer.exe schtasks.exe PID 1652 wrote to memory of 772 1652 internetexploer.exe schtasks.exe PID 1652 wrote to memory of 1972 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1972 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1972 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1972 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1392 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1392 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1392 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1392 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1724 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1724 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1724 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 1724 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 2000 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 2000 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 2000 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 2000 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 884 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 884 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 884 1652 internetexploer.exe internetexploer.exe PID 1652 wrote to memory of 884 1652 internetexploer.exe internetexploer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\origin.exe"C:\Users\Admin\AppData\Local\Temp\origin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oyGqcapvIL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oyGqcapvIL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp80D4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\origin.exe"C:\Users\Admin\AppData\Local\Temp\origin.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oyGqcapvIL.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oyGqcapvIL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2F0.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp80D4.tmpFilesize
1KB
MD5bd024b1cb179067ec0dc0f030a518f1e
SHA1c6625116f6890b636c668097f0a99403430e753e
SHA2565ea804b264aa0f75ce724d80fc71d776d31aa9c8c28bae855c16e1ab1bdc203c
SHA512b0264a202ea74991a6dc74c176b1b3cbf9a2fc548857d0f54717589dc256a6b241016f99370eccbbe375ed4c7511c7cbd0e7c7ccdcfec55d3b95d01606ef1cc7
-
C:\Users\Admin\AppData\Local\Temp\tmpE2F0.tmpFilesize
1KB
MD5bd024b1cb179067ec0dc0f030a518f1e
SHA1c6625116f6890b636c668097f0a99403430e753e
SHA2565ea804b264aa0f75ce724d80fc71d776d31aa9c8c28bae855c16e1ab1bdc203c
SHA512b0264a202ea74991a6dc74c176b1b3cbf9a2fc548857d0f54717589dc256a6b241016f99370eccbbe375ed4c7511c7cbd0e7c7ccdcfec55d3b95d01606ef1cc7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD513d0194d009c30c8bbb42c1fbe582fe3
SHA1e2844ced33461afab91649bef4506f8b486065b2
SHA2566eb033115bd520aafde2a292e3b948d1c075a3f0ee03f436e9d5b84721ccf0cd
SHA512c2a08faa04fb0fe7034d6d8cc0f3433f0ca1f1ba18f2f47d52d1414bb905548377a2c1cfaf22e688dbb0f3836bd53791058a016390e3b4f2028d53ae1006c049
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
memory/268-79-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-65-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-70-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-74-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-75-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-76-0x000000000040B556-mapping.dmp
-
memory/268-72-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-69-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-87-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-64-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-82-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/268-67-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/772-92-0x0000000000000000-mapping.dmp
-
memory/1128-101-0x000000006E8B0000-0x000000006EE5B000-memory.dmpFilesize
5.7MB
-
memory/1128-91-0x0000000000000000-mapping.dmp
-
memory/1204-60-0x0000000000000000-mapping.dmp
-
memory/1652-84-0x0000000000000000-mapping.dmp
-
memory/1652-88-0x00000000003A0000-0x000000000042A000-memory.dmpFilesize
552KB
-
memory/1652-90-0x0000000000350000-0x0000000000366000-memory.dmpFilesize
88KB
-
memory/1680-54-0x0000000000DB0000-0x0000000000E3A000-memory.dmpFilesize
552KB
-
memory/1680-63-0x0000000004260000-0x0000000004296000-memory.dmpFilesize
216KB
-
memory/1680-58-0x00000000055A0000-0x0000000005610000-memory.dmpFilesize
448KB
-
memory/1680-57-0x0000000000510000-0x000000000051E000-memory.dmpFilesize
56KB
-
memory/1680-56-0x00000000004A0000-0x00000000004B6000-memory.dmpFilesize
88KB
-
memory/1680-55-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1712-80-0x000000006E060000-0x000000006E60B000-memory.dmpFilesize
5.7MB
-
memory/1712-59-0x0000000000000000-mapping.dmp
-
memory/1712-81-0x000000006E060000-0x000000006E60B000-memory.dmpFilesize
5.7MB