warzonerat | 5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	product inquiry 20232803.pdf.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Windows security bypass 2 TTPs 2 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	product inquiry 20232803.pdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\product inquiry 20232803.pdf.exe = "0"	product inquiry 20232803.pdf.exe

Warzone RAT payload 6 IoCs

rat

resource	yara_rule
behavioral2/memory/1992-149-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1992-155-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1992-156-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1992-159-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1992-160-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1992-189-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	product inquiry 20232803.pdf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	product inquiry 20232803.pdf.exe

Loads dropped DLL 6 IoCs

pid	Process
1992	AddInProcess32.exe
1992	AddInProcess32.exe
1992	AddInProcess32.exe
1992	AddInProcess32.exe
1992	AddInProcess32.exe
1992	AddInProcess32.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 3 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	product inquiry 20232803.pdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	product inquiry 20232803.pdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\product inquiry 20232803.pdf.exe = "0"	product inquiry 20232803.pdf.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	product inquiry 20232803.pdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	product inquiry 20232803.pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4552 set thread context of 1992	4552	product inquiry 20232803.pdf.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
1856	powershell.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
1856	powershell.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe
4552	product inquiry 20232803.pdf.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4552	product inquiry 20232803.pdf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	product inquiry 20232803.pdf.exe
Token: SeLoadDriverPrivilege	4552	product inquiry 20232803.pdf.exe
Token: SeDebugPrivilege	4552	product inquiry 20232803.pdf.exe
Token: SeDebugPrivilege	1856	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1992	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1856	4552	product inquiry 20232803.pdf.exe	83
PID 4552 wrote to memory of 1856	4552	product inquiry 20232803.pdf.exe	83
PID 4552 wrote to memory of 3416	4552	product inquiry 20232803.pdf.exe	85
PID 4552 wrote to memory of 3416	4552	product inquiry 20232803.pdf.exe	85
PID 4552 wrote to memory of 3752	4552	product inquiry 20232803.pdf.exe	86
PID 4552 wrote to memory of 3752	4552	product inquiry 20232803.pdf.exe	86
PID 4552 wrote to memory of 3752	4552	product inquiry 20232803.pdf.exe	86
PID 4552 wrote to memory of 4404	4552	product inquiry 20232803.pdf.exe	87
PID 4552 wrote to memory of 4404	4552	product inquiry 20232803.pdf.exe	87
PID 4552 wrote to memory of 4116	4552	product inquiry 20232803.pdf.exe	88
PID 4552 wrote to memory of 4116	4552	product inquiry 20232803.pdf.exe	88
PID 4552 wrote to memory of 3252	4552	product inquiry 20232803.pdf.exe	89
PID 4552 wrote to memory of 3252	4552	product inquiry 20232803.pdf.exe	89
PID 4552 wrote to memory of 3240	4552	product inquiry 20232803.pdf.exe	90
PID 4552 wrote to memory of 3240	4552	product inquiry 20232803.pdf.exe	90
PID 4552 wrote to memory of 208	4552	product inquiry 20232803.pdf.exe	92
PID 4552 wrote to memory of 208	4552	product inquiry 20232803.pdf.exe	92
PID 4552 wrote to memory of 180	4552	product inquiry 20232803.pdf.exe	91
PID 4552 wrote to memory of 180	4552	product inquiry 20232803.pdf.exe	91
PID 4552 wrote to memory of 2588	4552	product inquiry 20232803.pdf.exe	93
PID 4552 wrote to memory of 2588	4552	product inquiry 20232803.pdf.exe	93
PID 4552 wrote to memory of 2980	4552	product inquiry 20232803.pdf.exe	94
PID 4552 wrote to memory of 2980	4552	product inquiry 20232803.pdf.exe	94
PID 4552 wrote to memory of 4884	4552	product inquiry 20232803.pdf.exe	95
PID 4552 wrote to memory of 4884	4552	product inquiry 20232803.pdf.exe	95
PID 4552 wrote to memory of 1256	4552	product inquiry 20232803.pdf.exe	96
PID 4552 wrote to memory of 1256	4552	product inquiry 20232803.pdf.exe	96
PID 4552 wrote to memory of 4388	4552	product inquiry 20232803.pdf.exe	97
PID 4552 wrote to memory of 4388	4552	product inquiry 20232803.pdf.exe	97
PID 4552 wrote to memory of 2120	4552	product inquiry 20232803.pdf.exe	98
PID 4552 wrote to memory of 2120	4552	product inquiry 20232803.pdf.exe	98
PID 4552 wrote to memory of 8	4552	product inquiry 20232803.pdf.exe	99
PID 4552 wrote to memory of 8	4552	product inquiry 20232803.pdf.exe	99
PID 4552 wrote to memory of 984	4552	product inquiry 20232803.pdf.exe	100
PID 4552 wrote to memory of 984	4552	product inquiry 20232803.pdf.exe	100
PID 4552 wrote to memory of 2308	4552	product inquiry 20232803.pdf.exe	101
PID 4552 wrote to memory of 2308	4552	product inquiry 20232803.pdf.exe	101
PID 4552 wrote to memory of 4532	4552	product inquiry 20232803.pdf.exe	102
PID 4552 wrote to memory of 4532	4552	product inquiry 20232803.pdf.exe	102
PID 4552 wrote to memory of 1152	4552	product inquiry 20232803.pdf.exe	103
PID 4552 wrote to memory of 1152	4552	product inquiry 20232803.pdf.exe	103
PID 4552 wrote to memory of 4104	4552	product inquiry 20232803.pdf.exe	104
PID 4552 wrote to memory of 4104	4552	product inquiry 20232803.pdf.exe	104
PID 4552 wrote to memory of 2356	4552	product inquiry 20232803.pdf.exe	105
PID 4552 wrote to memory of 2356	4552	product inquiry 20232803.pdf.exe	105
PID 4552 wrote to memory of 1096	4552	product inquiry 20232803.pdf.exe	106
PID 4552 wrote to memory of 1096	4552	product inquiry 20232803.pdf.exe	106
PID 4552 wrote to memory of 4660	4552	product inquiry 20232803.pdf.exe	107
PID 4552 wrote to memory of 4660	4552	product inquiry 20232803.pdf.exe	107
PID 4552 wrote to memory of 3236	4552	product inquiry 20232803.pdf.exe	108
PID 4552 wrote to memory of 3236	4552	product inquiry 20232803.pdf.exe	108
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 4552 wrote to memory of 1992	4552	product inquiry 20232803.pdf.exe	109
PID 1992 wrote to memory of 4156	1992	AddInProcess32.exe	110
PID 1992 wrote to memory of 4156	1992	AddInProcess32.exe	110

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	product inquiry 20232803.pdf.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\product inquiry 20232803.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\product inquiry 20232803.pdf.exe"
1⤵
- UAC bypass
- Windows security bypass
- Sets service image path in registry
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\product inquiry 20232803.pdf.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:3416
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:3752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
  2⤵
  PID:3252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:3240
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:180
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:2588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:2980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
  2⤵
  PID:1256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:4388
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:2120
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:8
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:2308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1152
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:4104
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:1096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:4660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  PID:3236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry