Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
order 2344536523465.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
order 2344536523465.exe
Resource
win10v2004-20231222-en
General
-
Target
order 2344536523465.exe
-
Size
655KB
-
MD5
ffc87746179f68d3e1a29144880c4fb7
-
SHA1
8fe2fab9866d4a679012d5191633363a6353b25a
-
SHA256
5823abce8aee97ca3b5178ea0bdddd88b23533397bbd3a29ae31dd44eb89feff
-
SHA512
e28f1b934548c74a841379da2578b6ad7e9902554e3e3c0e6bf86607551764f8a82dbf14d7bf7a87091198ca4f840492fe453e4d29b5b99a959d9e984c04e8f9
-
SSDEEP
12288:FW0/+MEFDmAwyAlaA31L1a6NDWxuW90dkLo/xhvyNP06BJI3:40GDo8A31L1f6xuTdkLeTvyNP04u
Malware Config
Extracted
warzonerat
84.38.132.126:59937
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 5 IoCs
resource yara_rule behavioral1/memory/2700-11-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral1/memory/2700-12-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral1/memory/2700-13-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral1/memory/2700-16-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral1/memory/2700-19-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1932 set thread context of 2700 1932 order 2344536523465.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2972 2700 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 1932 wrote to memory of 2700 1932 order 2344536523465.exe 28 PID 2700 wrote to memory of 2972 2700 order 2344536523465.exe 29 PID 2700 wrote to memory of 2972 2700 order 2344536523465.exe 29 PID 2700 wrote to memory of 2972 2700 order 2344536523465.exe 29 PID 2700 wrote to memory of 2972 2700 order 2344536523465.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\order 2344536523465.exe"C:\Users\Admin\AppData\Local\Temp\order 2344536523465.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\order 2344536523465.exe"C:\Users\Admin\AppData\Local\Temp\order 2344536523465.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 2003⤵
- Program crash
PID:2972
-
-