Analysis

  • max time kernel
    124s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14-02-2024 01:00

General

  • Target

    0923b96551a00cf7c004115637a4e0eb9d80ea8c6ab80c6515b3f3ca28bd5eb4.rtf

  • Size

    3KB

  • MD5

    08e4197b0f47a59e1061a1c30c445daa

  • SHA1

    a3c5eb519045be882bcc057f4df655789f542ee8

  • SHA256

    0923b96551a00cf7c004115637a4e0eb9d80ea8c6ab80c6515b3f3ca28bd5eb4

  • SHA512

    5b7a923f6cc6f1baddb728dce653b5af353cc1a2544348fd857b0ede029470307597e39a151460a79e4bd3963b8438ae55531dbb2d2f26fc55483c9c8ce8f336

Malware Config

Extracted

Family

warzonerat

C2

makatti.duckdns.org:3787

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 7 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0923b96551a00cf7c004115637a4e0eb9d80ea8c6ab80c6515b3f3ca28bd5eb4.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2184
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Users\Admin\AppData\Roaming\word.exe
        C:\Users\Admin\AppData\Roaming\word.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ERLoYztAgGbJ.exe"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1228
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ERLoYztAgGbJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56B8.tmp"
          3⤵
          • Creates scheduled task(s)
          PID:2360
        • C:\Users\Admin\AppData\Roaming\word.exe
          "C:\Users\Admin\AppData\Roaming\word.exe"
          3⤵
          • Executes dropped EXE
          PID:2544

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp56B8.tmp

      Filesize

      1KB

      MD5

      581f336398e7631c672ba54c4b8fa0f8

      SHA1

      265e06a28fa2800928991d7ec5567932559e3d4a

      SHA256

      b8051af5035d38c351c4a08a318fe508b7787a233f7b9ab94d44a881f7e697bb

      SHA512

      a2bbcb32f35b3b375e89cbb6ad0ecaaa07ccfafa2a8c354967be2ccd862d877dcbf2b1dc89e823e99984da3d04e5ecee5ffcb02307d77cf17f126319eeb25195

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      6836e317187e8a4da75f536372410dc9

      SHA1

      1f01434a3ebee54835891d32ae1c2686f81eedf4

      SHA256

      291a0ab7a90aa2e6c8f5a883b6281b9cfbeb94c6ce00da820cdd295a99b7aa6d

      SHA512

      ac741aeb57a663e3f64279e46d5b6fc55d047d5158bf39f4ce42de74f4df7f8f7444c3b6f42d9002d01039982a38542de80aa146ff94cb2c409a03c788b64b1f

    • C:\Users\Admin\AppData\Roaming\word.exe

      Filesize

      534KB

      MD5

      16cd177899279d5d2d27443286ccc41b

      SHA1

      91c1ee553aa8ac4cd24ef5800c6ac12da7becdee

      SHA256

      3e4da5132877e955fb455e58e300b56033c07a6d2709b386fdc5c43a88e1c499

      SHA512

      d1175ab4e807d9950f58b92663cf905413f6c73c5b5c3edf118ae9ae24455e20ed815169b6c279096fd0d7527784713300d66a4a77202b86b1a74c46d08b58c4

    • memory/1228-62-0x00000000643D0000-0x000000006497B000-memory.dmp

      Filesize

      5.7MB

    • memory/1228-61-0x0000000002B50000-0x0000000002B90000-memory.dmp

      Filesize

      256KB

    • memory/1228-60-0x0000000002B50000-0x0000000002B90000-memory.dmp

      Filesize

      256KB

    • memory/1228-58-0x0000000002B50000-0x0000000002B90000-memory.dmp

      Filesize

      256KB

    • memory/1228-57-0x00000000643D0000-0x000000006497B000-memory.dmp

      Filesize

      5.7MB

    • memory/1228-55-0x00000000643D0000-0x000000006497B000-memory.dmp

      Filesize

      5.7MB

    • memory/2544-56-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-50-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-54-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-32-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-34-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-36-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-38-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-40-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-42-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-46-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2544-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2796-16-0x0000000005230000-0x0000000005270000-memory.dmp

      Filesize

      256KB

    • memory/2796-53-0x000000006B0D0000-0x000000006B7BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2796-25-0x0000000000750000-0x000000000075E000-memory.dmp

      Filesize

      56KB

    • memory/2796-24-0x00000000006C0000-0x00000000006CA000-memory.dmp

      Filesize

      40KB

    • memory/2796-18-0x0000000000520000-0x0000000000534000-memory.dmp

      Filesize

      80KB

    • memory/2796-26-0x0000000000E90000-0x0000000000EF0000-memory.dmp

      Filesize

      384KB

    • memory/2796-15-0x000000006B0D0000-0x000000006B7BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2796-14-0x0000000001020000-0x00000000010AC000-memory.dmp

      Filesize

      560KB

    • memory/2924-0-0x000000002F0A1000-0x000000002F0A2000-memory.dmp

      Filesize

      4KB

    • memory/2924-59-0x0000000070F0D000-0x0000000070F18000-memory.dmp

      Filesize

      44KB

    • memory/2924-2-0x0000000070F0D000-0x0000000070F18000-memory.dmp

      Filesize

      44KB

    • memory/2924-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2924-80-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB