Extracted

• • Target

    Scan20237098.doc

  • Size

    1.1MB

  • MD5

    e5c494ecaf82d57a859336b49e431c5e

  • SHA1

    be239c1780cfec568382062adbf2b4111b55eac6

  • SHA256

    826f4301cfc33fc7621955053afc57d89fce92cf5a0075081112acf7239f1135

  • SHA512

    bdda9ebd8dc483fbc3cf476ecabf2dc81bd73ee18e2c2f97e51b1a4b669508c33a4584171bbf0540cab8f090802f04197c0ec71311c4b787b1379ea81eb68412

  • SSDEEP

    6144:Gab6QYdSvtJTRnUuCVT8j8PT0DSmOL5xtoPVzFt1RDAUww:GaOQ/fKuCN8jB+TL5gPVzFHRsUr

  Score

  10^/10

  warzoneratevasioninfostealerpersistenceratupx

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2