Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
babbb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
babbb.exe
Resource
win10v2004-20231222-en
General
-
Target
babbb.exe
-
Size
764KB
-
MD5
5040eb019a579d7d5b583ccc285c2732
-
SHA1
9a689878c6aee62a6f5f6634d05d999f543365bb
-
SHA256
0bf6ae6361d96420e17922aca4af1f02ab2f3f01d67cd14148f187fd2de4f51b
-
SHA512
c4efdb54a752e309a574b9a769f5b2365f65ee1690e322bb6364e288c5f8f3196eb4b5122979af517706d463c6f2291d05ca664b8a1d22c2abc6feed5b6c223f
-
SSDEEP
6144:F1NBdGYC2Ri6+GpplN8HTy4KV/ftexpq01Tek9TaASdJW6Di:F1N7GYtRi6Hczy4KJl+ekdaBJWF
Malware Config
Extracted
warzonerat
bossnew.ddns.net:1001
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 11 IoCs
resource yara_rule behavioral1/memory/2840-20-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-23-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-22-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-24-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-27-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-30-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-31-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-40-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2892-71-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2892-72-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2892-73-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe babbb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe babbb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe bab.exe -
Executes dropped EXE 5 IoCs
pid Process 2720 cvcvsdf.exe 2840 cvcvsdf.exe 2752 bab.exe 2596 cvcvsdf.exe 2892 cvcvsdf.exe -
Loads dropped DLL 5 IoCs
pid Process 1996 babbb.exe 1996 babbb.exe 2840 cvcvsdf.exe 2840 cvcvsdf.exe 2752 bab.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bab = "C:\\ProgramData\\bab.exe" cvcvsdf.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2720 set thread context of 2840 2720 cvcvsdf.exe 28 PID 2596 set thread context of 2892 2596 cvcvsdf.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1996 babbb.exe 2720 cvcvsdf.exe 2752 bab.exe 2596 cvcvsdf.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2720 1996 babbb.exe 27 PID 1996 wrote to memory of 2720 1996 babbb.exe 27 PID 1996 wrote to memory of 2720 1996 babbb.exe 27 PID 1996 wrote to memory of 2720 1996 babbb.exe 27 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2720 wrote to memory of 2840 2720 cvcvsdf.exe 28 PID 2840 wrote to memory of 2752 2840 cvcvsdf.exe 29 PID 2840 wrote to memory of 2752 2840 cvcvsdf.exe 29 PID 2840 wrote to memory of 2752 2840 cvcvsdf.exe 29 PID 2840 wrote to memory of 2752 2840 cvcvsdf.exe 29 PID 2752 wrote to memory of 2596 2752 bab.exe 30 PID 2752 wrote to memory of 2596 2752 bab.exe 30 PID 2752 wrote to memory of 2596 2752 bab.exe 30 PID 2752 wrote to memory of 2596 2752 bab.exe 30 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31 PID 2596 wrote to memory of 2892 2596 cvcvsdf.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\babbb.exe"C:\Users\Admin\AppData\Local\Temp\babbb.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\ProgramData\bab.exe"C:\ProgramData\bab.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"6⤵
- Executes dropped EXE
PID:2892
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764KB
MD55040eb019a579d7d5b583ccc285c2732
SHA19a689878c6aee62a6f5f6634d05d999f543365bb
SHA2560bf6ae6361d96420e17922aca4af1f02ab2f3f01d67cd14148f187fd2de4f51b
SHA512c4efdb54a752e309a574b9a769f5b2365f65ee1690e322bb6364e288c5f8f3196eb4b5122979af517706d463c6f2291d05ca664b8a1d22c2abc6feed5b6c223f