Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2023, 09:21

General

  • Target

    5767630484ddb02009fb82e7fbc23857a5b032fcbdca4b10bcd5abd3c1be1407.exe

  • Size

    323KB

  • MD5

    4521c3419b829108204529c88f4ca21a

  • SHA1

    a50140d0578559219c60af7171238f62055b3a92

  • SHA256

    5767630484ddb02009fb82e7fbc23857a5b032fcbdca4b10bcd5abd3c1be1407

  • SHA512

    51c7888274ecc08b70dc00a27f4d9f4d3f1b3901c1d541e9baeb362a06b491bb0f57bbf4a345d5ab6656df3b3e45e246fecb068d44ebc116112f383639b748ad

  • SSDEEP

    3072:5PgtxA/n5RF2p8b91/XXrB6pcTpYK236nYklNsWQDiuLpOdYfUBjdgvG:5Ced2891f7IpkYKTnDqLiqOdYf+WvG

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5767630484ddb02009fb82e7fbc23857a5b032fcbdca4b10bcd5abd3c1be1407.exe
    "C:\Users\Admin\AppData\Local\Temp\5767630484ddb02009fb82e7fbc23857a5b032fcbdca4b10bcd5abd3c1be1407.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4556
    • C:\Users\Admin\Documents\images.exe
      "C:\Users\Admin\Documents\images.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Add-MpPreference -ExclusionPath C:\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4192
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
          PID:4292
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x2f8 0x2f4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4480

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      3d086a433708053f9bf9523e1d87a4e8

      SHA1

      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

      SHA256

      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

      SHA512

      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      42e3933695ea152424221c440a6da7a0

      SHA1

      06d56b87d903f3808b5a53abf1845bd99e61884e

      SHA256

      c2354c245f25210dddb4467259cbd244955310efd6f1b63e04c8c512b4bbe086

      SHA512

      b8b2913b1cfb1a84c28834f057e601397eb118c3da614a749288cbafcac7b03578eb1954e1038b70f883f9f1e0fe8aeca0e0af12f4cec4e2b2acadcfa39d5f10

    • C:\Users\Admin\Documents\images.exe

      Filesize

      323KB

      MD5

      4521c3419b829108204529c88f4ca21a

      SHA1

      a50140d0578559219c60af7171238f62055b3a92

      SHA256

      5767630484ddb02009fb82e7fbc23857a5b032fcbdca4b10bcd5abd3c1be1407

      SHA512

      51c7888274ecc08b70dc00a27f4d9f4d3f1b3901c1d541e9baeb362a06b491bb0f57bbf4a345d5ab6656df3b3e45e246fecb068d44ebc116112f383639b748ad

    • C:\Users\Admin\Documents\images.exe

      Filesize

      323KB

      MD5

      4521c3419b829108204529c88f4ca21a

      SHA1

      a50140d0578559219c60af7171238f62055b3a92

      SHA256

      5767630484ddb02009fb82e7fbc23857a5b032fcbdca4b10bcd5abd3c1be1407

      SHA512

      51c7888274ecc08b70dc00a27f4d9f4d3f1b3901c1d541e9baeb362a06b491bb0f57bbf4a345d5ab6656df3b3e45e246fecb068d44ebc116112f383639b748ad

    • memory/2064-166-0x00000000005DC000-0x00000000005F2000-memory.dmp

      Filesize

      88KB

    • memory/2064-155-0x0000000000400000-0x0000000000590000-memory.dmp

      Filesize

      1.6MB

    • memory/2064-167-0x0000000000400000-0x0000000000590000-memory.dmp

      Filesize

      1.6MB

    • memory/2064-154-0x00000000005DC000-0x00000000005F2000-memory.dmp

      Filesize

      88KB

    • memory/4192-158-0x0000000074430000-0x000000007447C000-memory.dmp

      Filesize

      304KB

    • memory/4292-165-0x00000000006D0000-0x00000000006D1000-memory.dmp

      Filesize

      4KB

    • memory/4456-143-0x0000000000400000-0x0000000000590000-memory.dmp

      Filesize

      1.6MB

    • memory/4456-142-0x00000000005DF000-0x00000000005F5000-memory.dmp

      Filesize

      88KB

    • memory/4456-134-0x0000000000400000-0x0000000000590000-memory.dmp

      Filesize

      1.6MB

    • memory/4456-133-0x00000000022F0000-0x0000000002315000-memory.dmp

      Filesize

      148KB

    • memory/4456-138-0x0000000000400000-0x0000000000590000-memory.dmp

      Filesize

      1.6MB

    • memory/4456-132-0x00000000005DF000-0x00000000005F5000-memory.dmp

      Filesize

      88KB

    • memory/4556-150-0x0000000007590000-0x00000000075AE000-memory.dmp

      Filesize

      120KB

    • memory/4556-152-0x0000000007740000-0x000000000775A000-memory.dmp

      Filesize

      104KB

    • memory/4556-153-0x00000000077B0000-0x00000000077BA000-memory.dmp

      Filesize

      40KB

    • memory/4556-151-0x0000000007D80000-0x00000000083FA000-memory.dmp

      Filesize

      6.5MB

    • memory/4556-149-0x0000000074430000-0x000000007447C000-memory.dmp

      Filesize

      304KB

    • memory/4556-156-0x00000000079C0000-0x0000000007A56000-memory.dmp

      Filesize

      600KB

    • memory/4556-148-0x00000000075B0000-0x00000000075E2000-memory.dmp

      Filesize

      200KB

    • memory/4556-147-0x00000000064A0000-0x00000000064BE000-memory.dmp

      Filesize

      120KB

    • memory/4556-159-0x00000000079B0000-0x00000000079BE000-memory.dmp

      Filesize

      56KB

    • memory/4556-160-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

      Filesize

      104KB

    • memory/4556-161-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

      Filesize

      32KB

    • memory/4556-145-0x0000000005DE0000-0x0000000005E46000-memory.dmp

      Filesize

      408KB

    • memory/4556-146-0x0000000005E50000-0x0000000005EB6000-memory.dmp

      Filesize

      408KB

    • memory/4556-144-0x0000000005D40000-0x0000000005D62000-memory.dmp

      Filesize

      136KB

    • memory/4556-137-0x00000000055E0000-0x0000000005C08000-memory.dmp

      Filesize

      6.2MB

    • memory/4556-136-0x0000000002A80000-0x0000000002AB6000-memory.dmp

      Filesize

      216KB