Analysis

  • max time kernel
    102s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2023, 13:37

General

  • Target

    Jiuwu Hi-tech Pricelist February 2023.rtf

  • Size

    1.8MB

  • MD5

    556b264242dcc56d9b3f0de7953e59fb

  • SHA1

    f55783b7ca683847f624a0892c5e9274c7a1f72c

  • SHA256

    19831af2350c4b69c5abfd09278248334c964836ce9b93f9cfb8cd0300fd8e87

  • SHA512

    b0d5dcee9bd7b2d175371c7f4455a0ab8dc17d5bd292ee7509180e8759c84a26ce05eae87fa0726d455e2fdaa355b13df846aeb6ebfdc8a71475cab49af906ad

  • SSDEEP

    24576:Caexas2pTj4fcktkaBDUopf15clvypcvkfE2g8NyQ2gGj/951WtpWBv5JnDbELgr:Z

Malware Config

Extracted

Family

warzonerat

C2

blackroots7.duckdns.org:1104

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Jiuwu Hi-tech Pricelist February 2023.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:848
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Users\Admin\AppData\Roaming\word.exe
        C:\Users\Admin\AppData\Roaming\word.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Users\Admin\AppData\Local\Temp\avxyq.exe
          "C:\Users\Admin\AppData\Local\Temp\avxyq.exe" C:\Users\Admin\AppData\Local\Temp\efkmzemi.oij
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:728
          • C:\Users\Admin\AppData\Local\Temp\avxyq.exe
            "C:\Users\Admin\AppData\Local\Temp\avxyq.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1108

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • C:\Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • C:\Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • C:\Users\Admin\AppData\Local\Temp\efkmzemi.oij

            Filesize

            7KB

            MD5

            6bd6d3f8e44429f2be3e2d45bb17f2f2

            SHA1

            76e8137a69cb6b15ff0194d67e1fb91aa0e9aed0

            SHA256

            74538cb526634df66399cba1d4fddc07427059fd81842160ee52aee8b33feff8

            SHA512

            f142917a41e9d5de39e6818c660c569a9e3b3db96d22c5af2e273a2d5045976593c805d7266a8d4545eb013461c24159b7f70aa3cf405cb1c8cde44a3e26ae0e

          • C:\Users\Admin\AppData\Local\Temp\narwbaekgvw.wt

            Filesize

            118KB

            MD5

            bbaa20f28881493009df30cd773b0cc5

            SHA1

            ac779c0fd7e238a79720d29e837755b011770710

            SHA256

            0d3de13a7c6651962965e736e1b44d6fb299b53dc7267cdbbd3170d2fa77b07b

            SHA512

            1d4ef3750936f99778aab04ad81b774cadcb966f08e73a6be935896e81b9ff45e7b3e519391ce54935dae56654b809e8391a9f03d5721956b5d051256cad6242

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

            Filesize

            20KB

            MD5

            2b3b7535633a6f3875c721e1e8148728

            SHA1

            b161a8c9f1870cb18bc81c757c9d0a303fe94d11

            SHA256

            6db00ba456f044588b0ff68c4fc8eeb0f12781b29d40b049fd841cebbd391120

            SHA512

            3279134af58f32b8fd2680f8d886fe96d004e8046c71eedfeadfa0b8958928495a3d8e6f5f0b1ec7a4b82ebdfee6f68715ab8f52ad12ff52eaff83f2f7cf09f5

          • C:\Users\Admin\AppData\Roaming\word.exe

            Filesize

            202KB

            MD5

            28c462381899d5a4f67656944b6025f9

            SHA1

            97daf057dd9f1d1c7d3ef9ed222b46fbda7a52cb

            SHA256

            da029a807d20d6ab41299ae370424cc78fab56d7ee97d11f1156f4e99e54c87a

            SHA512

            d6b86feddbc0af9ff7db8d9e4ec718950d38f60a0d96595ef71c386855607db98ca26eee566205a662d07ae0cb6874bd81eccf45f6352eaa9e613a58b9d64283

          • C:\Users\Admin\AppData\Roaming\word.exe

            Filesize

            202KB

            MD5

            28c462381899d5a4f67656944b6025f9

            SHA1

            97daf057dd9f1d1c7d3ef9ed222b46fbda7a52cb

            SHA256

            da029a807d20d6ab41299ae370424cc78fab56d7ee97d11f1156f4e99e54c87a

            SHA512

            d6b86feddbc0af9ff7db8d9e4ec718950d38f60a0d96595ef71c386855607db98ca26eee566205a662d07ae0cb6874bd81eccf45f6352eaa9e613a58b9d64283

          • C:\Users\Admin\AppData\Roaming\word.exe

            Filesize

            202KB

            MD5

            28c462381899d5a4f67656944b6025f9

            SHA1

            97daf057dd9f1d1c7d3ef9ed222b46fbda7a52cb

            SHA256

            da029a807d20d6ab41299ae370424cc78fab56d7ee97d11f1156f4e99e54c87a

            SHA512

            d6b86feddbc0af9ff7db8d9e4ec718950d38f60a0d96595ef71c386855607db98ca26eee566205a662d07ae0cb6874bd81eccf45f6352eaa9e613a58b9d64283

          • \Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • \Users\Admin\AppData\Local\Temp\avxyq.exe

            Filesize

            60KB

            MD5

            156ed6700ef54cfa83a1a220e842a328

            SHA1

            3cebd8e30387e6fbcd235dfd5f38240e660a2fc7

            SHA256

            d331afaea61b2e228760e493dc3849c1161a782d1dae1a7098262c0983bf6f11

            SHA512

            c5ee0c10641837707b5b0d034e7fa50891ca45968a7e360e7970e9ab4ff2f66132c75a2a72db8d50511b1ef9366bc5deeae73f9ce744ca583eaf445d69b6608b

          • \Users\Admin\AppData\Roaming\word.exe

            Filesize

            202KB

            MD5

            28c462381899d5a4f67656944b6025f9

            SHA1

            97daf057dd9f1d1c7d3ef9ed222b46fbda7a52cb

            SHA256

            da029a807d20d6ab41299ae370424cc78fab56d7ee97d11f1156f4e99e54c87a

            SHA512

            d6b86feddbc0af9ff7db8d9e4ec718950d38f60a0d96595ef71c386855607db98ca26eee566205a662d07ae0cb6874bd81eccf45f6352eaa9e613a58b9d64283

          • memory/1048-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1048-108-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1108-78-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1108-82-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1108-84-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1108-85-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB