Analysis
-
max time kernel
203s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 11:14
Static task
static1
1 signatures
General
-
Target
RubyWave - warface AI.exe
-
Size
1.7MB
-
MD5
1c57c869d17b810587914329105f2419
-
SHA1
0fde9cfafacadab5024fb620635bcf3f30327b16
-
SHA256
a792c75b9d064e82010ed25e4d7d0542278959d3989c4b3187a5885100e11d14
-
SHA512
0bb106e7210928117d10d9bfc75d46629f9a26b9c52727ae2d9cf243ff8adb1035017b5b4bac7b81d3a81f4c2ac85c817b2b7cd644760d876f9098c5f265fe2d
-
SSDEEP
24576:2TbBv5rUyXVYGGT0AJ8lFQbLOt5UcaNuMIuw1pLw9JShkvUOFe/B13279F2wGn2V:IBJxa/Wla+UwMnELmRvUHGz5G2PllP9
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
resource yara_rule behavioral1/files/0x00080000000233fa-10.dat family_zgrat_v1 behavioral1/memory/4076-13-0x00000000009C0000-0x0000000000BA6000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Runtimeperfdhcp.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation RubyWave - warface AI.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 2 IoCs
pid Process 4076 Runtimeperfdhcp.exe 3312 csrss.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\Registry.exe Runtimeperfdhcp.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\ee2ad38f3d4382 Runtimeperfdhcp.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\dllhost.exe Runtimeperfdhcp.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\5940a34987c991 Runtimeperfdhcp.exe File created C:\Program Files\Windows Defender\it-IT\upfc.exe Runtimeperfdhcp.exe File created C:\Program Files\Windows Defender\it-IT\ea1d8f6d871115 Runtimeperfdhcp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings RubyWave - warface AI.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings Runtimeperfdhcp.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2348 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe 4076 Runtimeperfdhcp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3312 csrss.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4076 Runtimeperfdhcp.exe Token: SeDebugPrivilege 3312 csrss.exe Token: SeDebugPrivilege 5116 taskmgr.exe Token: SeSystemProfilePrivilege 5116 taskmgr.exe Token: SeCreateGlobalPrivilege 5116 taskmgr.exe Token: 33 5116 taskmgr.exe Token: SeIncBasePriorityPrivilege 5116 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe 5116 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2912 2692 RubyWave - warface AI.exe 83 PID 2692 wrote to memory of 2912 2692 RubyWave - warface AI.exe 83 PID 2692 wrote to memory of 2912 2692 RubyWave - warface AI.exe 83 PID 2912 wrote to memory of 3720 2912 WScript.exe 87 PID 2912 wrote to memory of 3720 2912 WScript.exe 87 PID 2912 wrote to memory of 3720 2912 WScript.exe 87 PID 3720 wrote to memory of 4076 3720 cmd.exe 89 PID 3720 wrote to memory of 4076 3720 cmd.exe 89 PID 4076 wrote to memory of 1472 4076 Runtimeperfdhcp.exe 91 PID 4076 wrote to memory of 1472 4076 Runtimeperfdhcp.exe 91 PID 1472 wrote to memory of 4128 1472 cmd.exe 93 PID 1472 wrote to memory of 4128 1472 cmd.exe 93 PID 1472 wrote to memory of 2348 1472 cmd.exe 94 PID 1472 wrote to memory of 2348 1472 cmd.exe 94 PID 1472 wrote to memory of 3312 1472 cmd.exe 105 PID 1472 wrote to memory of 3312 1472 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\RubyWave - warface AI.exe"C:\Users\Admin\AppData\Local\Temp\RubyWave - warface AI.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hyperchainWebSavesHost\C3oHAXCjllIjyA4thIc5NSBg8yvnq.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hyperchainWebSavesHost\BHs6uvIkOQOMGM2Zpb6kJ4ur82VMB.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\hyperchainWebSavesHost\Runtimeperfdhcp.exe"C:\hyperchainWebSavesHost/Runtimeperfdhcp.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gR2NETWhYi.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\system32\chcp.comchcp 650016⤵PID:4128
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
PID:2348
-
-
C:\Users\Default\Desktop\csrss.exe"C:\Users\Default\Desktop\csrss.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1540
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD587897500695485dc2daa7de345210bce
SHA181a0a04abb077c26152064744776f5b53a255e36
SHA2568ddf75af49daa4d4fa3602111e1b2c07360444945ad809f92ec53391574eceff
SHA512c477d4ed936e59a2a8d6b26e3d827b74a53f6f84d5791e18aefbfc244720ba8626ed83272856088ed20c101accbd90686a0728e2f764f3b6f9b5caf26d3b6eac
-
Filesize
89B
MD5992551141d99f529c430090564431322
SHA1df5ff7e5363c390c20df042911be2b74b7dc4e89
SHA256b91b1e34f6961b454449cdf1255b1079979932c503d35f0c89420337e3096f06
SHA512d6200f4391d10f7c0592aea529463c93b32f70fd9bde4c469e7e50f3e195777126e5aeb498336340c4a55490fca1c8501b7129a560ff62f83c643a8c69e42a68
-
Filesize
229B
MD5b6277c585f3f9bce431ddc0bcf3e8345
SHA16bd292b0ea94285fb8d02bcc663b8f8caba12c1c
SHA2568256503ea1b4ae6f1914eb5a13921b3fd6fd778eb2a8229fadfa6d07a03d91c9
SHA512b405ad2970a48677aa8e7df85c0ceb2b8396b3552ce6f482b54a58f24805269ae20055909fa0e8c095d1ea0d7546b5462b57a32c6786ae93935796a36f124e72
-
Filesize
1.9MB
MD59d8553ed1a60b8d1675f7669d0ec6bb2
SHA10d118ea90a509176f87b68c42e7d63f27393190e
SHA25647f3e8f21bb8c1f7739e7f2199989356111105782b3e7e0b6fd6922d5f717e0a
SHA512c686ef951974d4852e93b2a8754b7e9a104a17ed6289e6439e16b96c8824db4b0d80676fa712d1acdbde2f31a8e0f1f6adc8e7af2762bce0fd8f3185d2f1a332