Analysis
- max time kernel
145s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2023, 10:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target file.exe
- Size 403KB
- Sample230601-mntbjadg79
- SHA256 8c95992bf35e5bc0d46244bf2330bec5711f409cb7fba2a2d52c28ed54ca4e80
- MD5 0bbf771c23e77d0f67ac68e739f8bd5b
- SHA1 ca5612a8739476297c7b8535f7a34f020bacf8a8
- SHA512 cdc58bb031e9fe1691691a5dc4ca51d35754efae67f6919f47ec47681b6a2d938b82f2fbbe605b14ab2e84a4eabfd5b9545b40419491defbd92f65820bc0a538
- SSDEEP 6144:hP1IAsudOs2633urCApOlOpT/leT78bJFdIY/xDDDzjltY7QMq/TfL9Y2bd:bisH3eCApOUpT/ccWUZlCCjLeE
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
91.193.75.154:4449
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe - WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\svchost.exe = "0" svchost.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions file.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions svchost.exe - Warzone RAT payload 5 IoCs
resource yara_rule behavioral2/memory/372-154-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/372-157-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/372-163-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/372-164-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/372-165-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools file.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools svchost.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" svchost.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation file.exe - Executes dropped EXE 1 IoCs
pid Process 4208 svchost.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\svchost.exe = "0" svchost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" file.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum file.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 file.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4208 set thread context of 372 4208 svchost.exe 102 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2812 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4228 timeout.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4536 file.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 2556 powershell.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 2556 powershell.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4208 svchost.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4536 file.exe Token: SeDebugPrivilege 4208 svchost.exe Token: SeDebugPrivilege 4208 svchost.exe Token: SeLoadDriverPrivilege 4208 svchost.exe Token: SeDebugPrivilege 2556 powershell.exe Token: 33 1308 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1308 AUDIODG.EXE - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4536 wrote to memory of 2104 4536 file.exe 82 PID 4536 wrote to memory of 2104 4536 file.exe 82 PID 4536 wrote to memory of 2504 4536 file.exe 83 PID 4536 wrote to memory of 2504 4536 file.exe 83 PID 2504 wrote to memory of 4228 2504 cmd.exe 86 PID 2504 wrote to memory of 4228 2504 cmd.exe 86 PID 2104 wrote to memory of 2812 2104 cmd.exe 87 PID 2104 wrote to memory of 2812 2104 cmd.exe 87 PID 2504 wrote to memory of 4208 2504 cmd.exe 88 PID 2504 wrote to memory of 4208 2504 cmd.exe 88 PID 4208 wrote to memory of 2556 4208 svchost.exe 89 PID 4208 wrote to memory of 2556 4208 svchost.exe 89 PID 4208 wrote to memory of 4756 4208 svchost.exe 91 PID 4208 wrote to memory of 4756 4208 svchost.exe 91 PID 4208 wrote to memory of 4364 4208 svchost.exe 93 PID 4208 wrote to memory of 4364 4208 svchost.exe 93 PID 4208 wrote to memory of 2696 4208 svchost.exe 92 PID 4208 wrote to memory of 2696 4208 svchost.exe 92 PID 4208 wrote to memory of 3480 4208 svchost.exe 94 PID 4208 wrote to memory of 3480 4208 svchost.exe 94 PID 4208 wrote to memory of 4344 4208 svchost.exe 95 PID 4208 wrote to memory of 4344 4208 svchost.exe 95 PID 4208 wrote to memory of 220 4208 svchost.exe 96 PID 4208 wrote to memory of 220 4208 svchost.exe 96 PID 4208 wrote to memory of 2444 4208 svchost.exe 106 PID 4208 wrote to memory of 2444 4208 svchost.exe 106 PID 4208 wrote to memory of 232 4208 svchost.exe 105 PID 4208 wrote to memory of 232 4208 svchost.exe 105 PID 4208 wrote to memory of 32 4208 svchost.exe 97 PID 4208 wrote to memory of 32 4208 svchost.exe 97 PID 4208 wrote to memory of 4928 4208 svchost.exe 98 PID 4208 wrote to memory of 4928 4208 svchost.exe 98 PID 4208 wrote to memory of 4204 4208 svchost.exe 104 PID 4208 wrote to memory of 4204 4208 svchost.exe 104 PID 4208 wrote to memory of 4272 4208 svchost.exe 101 PID 4208 wrote to memory of 4272 4208 svchost.exe 101 PID 4208 wrote to memory of 4828 4208 svchost.exe 99 PID 4208 wrote to memory of 4828 4208 svchost.exe 99 PID 4208 wrote to memory of 1616 4208 svchost.exe 100 PID 4208 wrote to memory of 1616 4208 svchost.exe 100 PID 4208 wrote to memory of 4528 4208 svchost.exe 103 PID 4208 wrote to memory of 4528 4208 svchost.exe 103 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 PID 4208 wrote to memory of 372 4208 svchost.exe 102 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
PID:2812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp670C.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4228
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Sets service image path in registry
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"4⤵PID:4756
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"4⤵PID:2696
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"4⤵PID:4364
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"4⤵PID:3480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"4⤵PID:4344
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"4⤵PID:220
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"4⤵PID:32
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"4⤵PID:4928
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"4⤵PID:4828
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"4⤵PID:1616
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"4⤵PID:4272
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"4⤵PID:372
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"4⤵PID:4528
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵PID:4204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"4⤵PID:232
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"4⤵PID:2444
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3c4 0x3bc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_23i2tzkm.dxd.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\tmp670C.tmp.bat
- Size 151B
- SHA256 a235d7b804f629d2a3aaf7c213da2cec68130f43b41c7ea34d17019ea007b2d9
- MD5 07df2b89ced2d7a451bd4b6aab62123c
- SHA1 5c39b63c752c6e4d8ce729209375db20f49007bf
- SHA512 5da08bb36e48aa9662e164effc9d2c371118b793d9cdb163acc327daef0d605acc773ed555dc3cf65f6c835b94b678ca3855ff8b59113d5ca0d44d1039e9cf45
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\svchost.exe
- Size 403KB
- SHA256 8c95992bf35e5bc0d46244bf2330bec5711f409cb7fba2a2d52c28ed54ca4e80
- MD5 0bbf771c23e77d0f67ac68e739f8bd5b
- SHA1 ca5612a8739476297c7b8535f7a34f020bacf8a8
- SHA512 cdc58bb031e9fe1691691a5dc4ca51d35754efae67f6919f47ec47681b6a2d938b82f2fbbe605b14ab2e84a4eabfd5b9545b40419491defbd92f65820bc0a538
- SSDEEP 6144:hP1IAsudOs2633urCApOlOpT/leT78bJFdIY/xDDDzjltY7QMq/TfL9Y2bd:bisH3eCApOUpT/ccWUZlCCjLeE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\svchost.exe
- Size 403KB
- SHA256 8c95992bf35e5bc0d46244bf2330bec5711f409cb7fba2a2d52c28ed54ca4e80
- MD5 0bbf771c23e77d0f67ac68e739f8bd5b
- SHA1 ca5612a8739476297c7b8535f7a34f020bacf8a8
- SHA512 cdc58bb031e9fe1691691a5dc4ca51d35754efae67f6919f47ec47681b6a2d938b82f2fbbe605b14ab2e84a4eabfd5b9545b40419491defbd92f65820bc0a538
- SSDEEP 6144:hP1IAsudOs2633urCApOlOpT/leT78bJFdIY/xDDDzjltY7QMq/TfL9Y2bd:bisH3eCApOUpT/ccWUZlCCjLeE
- MD5 SHA1 SHA512 SSDEEP