Analysis

  • max time kernel
    108s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2023, 13:36

General

  • Target

    Jiuwu Hi-tech Pricelist February 2023.rtf

  • Size

    1.8MB

  • MD5

    556b264242dcc56d9b3f0de7953e59fb

  • SHA1

    f55783b7ca683847f624a0892c5e9274c7a1f72c

  • SHA256

    19831af2350c4b69c5abfd09278248334c964836ce9b93f9cfb8cd0300fd8e87

  • SHA512

    b0d5dcee9bd7b2d175371c7f4455a0ab8dc17d5bd292ee7509180e8759c84a26ce05eae87fa0726d455e2fdaa355b13df846aeb6ebfdc8a71475cab49af906ad

  • SSDEEP

    24576:Caexas2pTj4fcktkaBDUopf15clvypcvkfE2g8NyQ2gGj/951WtpWBv5JnDbELgr:Z

Malware Config

Extracted

Family

warzonerat

C2

blackroots7.duckdns.org:1104

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Jiuwu Hi-tech Pricelist February 2023.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1104
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Users\Admin\AppData\Roaming\word.exe
        C:\Users\Admin\AppData\Roaming\word.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Users\Admin\AppData\Local\Temp\avxyq.exe
          "C:\Users\Admin\AppData\Local\Temp\avxyq.exe" C:\Users\Admin\AppData\Local\Temp\efkmzemi.oij
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Users\Admin\AppData\Local\Temp\avxyq.exe
            "C:\Users\Admin\AppData\Local\Temp\avxyq.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1972
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 184
              5⤵
              • Loads dropped DLL
              • Program crash
              PID:1408

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • C:\Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • C:\Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • C:\Users\Admin\AppData\Local\Temp\efkmzemi.oij

            Filesize

            7KB

            MD5

            6bd6d3f8e44429f2be3e2d45bb17f2f2

            SHA1

            76e8137a69cb6b15ff0194d67e1fb91aa0e9aed0

            SHA256

            74538cb526634df66399cba1d4fddc07427059fd81842160ee52aee8b33feff8

            SHA512

            f142917a41e9d5de39e6818c660c569a9e3b3db96d22c5af2e273a2d5045976593c805d7266a8d4545eb013461c24159b7f70aa3cf405cb1c8cde44a3e26ae0e

          • C:\Users\Admin\AppData\Local\Temp\narwbaekgvw.wt

            Filesize

            118KB

            MD5

            bbaa20f28881493009df30cd773b0cc5

            SHA1

            ac779c0fd7e238a79720d29e837755b011770710

            SHA256

            0d3de13a7c6651962965e736e1b44d6fb299b53dc7267cdbbd3170d2fa77b07b

            SHA512

            1d4ef3750936f99778aab04ad81b774cadcb966f08e73a6be935896e81b9ff45e7b3e519391ce54935dae56654b809e8391a9f03d5721956b5d051256cad6242

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

            Filesize

            20KB

            MD5

            6985329def35c234a5292ea87acd51b4

            SHA1

            b98ba4d0f12581d7b58f93b95a5b71275b1f6b68

            SHA256

            bb7dc0565a128929283c29866709a836fa34672e251cc0a0e9a4ec94e5a5cb99

            SHA512

            4e455faa889bab2293711c614684286d1303a87983c34ee625ad2a61aac49f925a13dd78c80ad3e818d4a55703decd85a4764e7d891e7d1302ce4d9c739d50aa

          • C:\Users\Admin\AppData\Roaming\word.exe

            Filesize

            202KB

            MD5

            28c462381899d5a4f67656944b6025f9

            SHA1

            97daf057dd9f1d1c7d3ef9ed222b46fbda7a52cb

            SHA256

            da029a807d20d6ab41299ae370424cc78fab56d7ee97d11f1156f4e99e54c87a

            SHA512

            d6b86feddbc0af9ff7db8d9e4ec718950d38f60a0d96595ef71c386855607db98ca26eee566205a662d07ae0cb6874bd81eccf45f6352eaa9e613a58b9d64283

          • C:\Users\Admin\AppData\Roaming\word.exe

            Filesize

            202KB

            MD5

            28c462381899d5a4f67656944b6025f9

            SHA1

            97daf057dd9f1d1c7d3ef9ed222b46fbda7a52cb

            SHA256

            da029a807d20d6ab41299ae370424cc78fab56d7ee97d11f1156f4e99e54c87a

            SHA512

            d6b86feddbc0af9ff7db8d9e4ec718950d38f60a0d96595ef71c386855607db98ca26eee566205a662d07ae0cb6874bd81eccf45f6352eaa9e613a58b9d64283

          • C:\Users\Admin\AppData\Roaming\word.exe

            Filesize

            202KB

            MD5

            28c462381899d5a4f67656944b6025f9

            SHA1

            97daf057dd9f1d1c7d3ef9ed222b46fbda7a52cb

            SHA256

            da029a807d20d6ab41299ae370424cc78fab56d7ee97d11f1156f4e99e54c87a

            SHA512

            d6b86feddbc0af9ff7db8d9e4ec718950d38f60a0d96595ef71c386855607db98ca26eee566205a662d07ae0cb6874bd81eccf45f6352eaa9e613a58b9d64283

          • \Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • \Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • \Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • \Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • \Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • \Users\Admin\AppData\Roaming\word.exe

            Filesize

            202KB

            MD5

            28c462381899d5a4f67656944b6025f9

            SHA1

            97daf057dd9f1d1c7d3ef9ed222b46fbda7a52cb

            SHA256

            da029a807d20d6ab41299ae370424cc78fab56d7ee97d11f1156f4e99e54c87a

            SHA512

            d6b86feddbc0af9ff7db8d9e4ec718950d38f60a0d96595ef71c386855607db98ca26eee566205a662d07ae0cb6874bd81eccf45f6352eaa9e613a58b9d64283

          • memory/1380-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1380-118-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1972-78-0x0000000000080000-0x000000000009D000-memory.dmp

            Filesize

            116KB

          • memory/1972-85-0x0000000000080000-0x000000000009D000-memory.dmp

            Filesize

            116KB

          • memory/1972-91-0x0000000000080000-0x000000000009D000-memory.dmp

            Filesize

            116KB