Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEAS.92b4986bc8e2e6631dbfa1e09fb95300.exe
-
Size
576KB
-
Sample
231106-dlt1lsaa63
-
MD5
92b4986bc8e2e6631dbfa1e09fb95300
-
SHA1
15207ba5bbaef76321752be90dba3ebcdc6b685c
-
SHA256
134601a3fa4dd4f8acd601bd1fd03f0f2acfbfc75e98731e140f9f0a362c017f
-
SHA512
e65b2d9712435a85a2d50f6c292d857ad7b3e04e0553b23d0d32526c3ede03ffab4667e9d899bc11c012bef018666645e97727a65fda5d0e02679a9e906659d0
-
SSDEEP
12288:el3zhdaE/jMRSrv0BNTMZtTQhm/iBjhrtDUnjP7Gu72JDl9gNaS:i31QEoRSrv0BNT8ehm6ROjiu7aD
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.92b4986bc8e2e6631dbfa1e09fb95300.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.92b4986bc8e2e6631dbfa1e09fb95300.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
warzonerat
kraldeli.linkpc.net:5200
Targets
-
-
Target
NEAS.92b4986bc8e2e6631dbfa1e09fb95300.exe
-
Size
576KB
-
MD5
92b4986bc8e2e6631dbfa1e09fb95300
-
SHA1
15207ba5bbaef76321752be90dba3ebcdc6b685c
-
SHA256
134601a3fa4dd4f8acd601bd1fd03f0f2acfbfc75e98731e140f9f0a362c017f
-
SHA512
e65b2d9712435a85a2d50f6c292d857ad7b3e04e0553b23d0d32526c3ede03ffab4667e9d899bc11c012bef018666645e97727a65fda5d0e02679a9e906659d0
-
SSDEEP
12288:el3zhdaE/jMRSrv0BNTMZtTQhm/iBjhrtDUnjP7Gu72JDl9gNaS:i31QEoRSrv0BNT8ehm6ROjiu7aD
Score10/10-
Modifies WinLogon for persistence
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Nirsoft
-
Warzone RAT payload
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1