Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25/02/2023, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe
Resource
win10v2004-20230221-en
General
-
Target
e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe
-
Size
848KB
-
MD5
5ef276a7d78356769c2f5158b631366d
-
SHA1
16843874d6ba640b5e3cd484fdb6c5519c215da1
-
SHA256
e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745
-
SHA512
2e00ada5de8977b26ea9e911cd8ab9eb0e6a1d6895d2e19fa293d4f385eb41f06188c31feefecfc3b4b60d79b52df0a25c424ba081c5631ab270876af26edace
-
SSDEEP
12288:ARqKnlpgIuS0A3ROhx5sC0olr28mdJ2sDttfU31gWybr2ay4eaIXSPJcHs3JzVvO:ARqLIuAR4x5sChlqBjJM3mWy7ILMg
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1308 set thread context of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 1160 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe Token: SeDebugPrivilege 1160 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1308 wrote to memory of 1160 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 28 PID 1308 wrote to memory of 1160 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 28 PID 1308 wrote to memory of 1160 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 28 PID 1308 wrote to memory of 1160 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 28 PID 1308 wrote to memory of 1628 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 30 PID 1308 wrote to memory of 1628 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 30 PID 1308 wrote to memory of 1628 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 30 PID 1308 wrote to memory of 1628 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 30 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32 PID 1308 wrote to memory of 300 1308 e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe"C:\Users\Admin\AppData\Local\Temp\e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TARQmutZ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TARQmutZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC360.tmp"2⤵
- Creates scheduled task(s)
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe"C:\Users\Admin\AppData\Local\Temp\e0502d39c8e63b66265eefe36bae775d0178a4f897958164cf97276ff2b2b745.exe"2⤵PID:300
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b290fabe9a7deb505f9862bb305fdf57
SHA1b1e43c291d1c7d9361ba2ab9cf9a5da0a94693f0
SHA25681a9332df9035f792e1495b2eb6810aa705c14ef8d16e9bedb1e84d86500e7be
SHA51221f20f83c95777d7b4c09a8579863c3f38f8fa27d6c113b7ba17cfa1f1b5e0a194f2bd0337373e89ad0a02e529f6acc64bb3702469c647d1c67bb74e45ac106c