Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 11:17
Static task
static1
1 signatures
General
-
Target
RubyWave - warface AI.exe
-
Size
1.7MB
-
MD5
1c57c869d17b810587914329105f2419
-
SHA1
0fde9cfafacadab5024fb620635bcf3f30327b16
-
SHA256
a792c75b9d064e82010ed25e4d7d0542278959d3989c4b3187a5885100e11d14
-
SHA512
0bb106e7210928117d10d9bfc75d46629f9a26b9c52727ae2d9cf243ff8adb1035017b5b4bac7b81d3a81f4c2ac85c817b2b7cd644760d876f9098c5f265fe2d
-
SSDEEP
24576:2TbBv5rUyXVYGGT0AJ8lFQbLOt5UcaNuMIuw1pLw9JShkvUOFe/B13279F2wGn2V:IBJxa/Wla+UwMnELmRvUHGz5G2PllP9
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023414-10.dat family_zgrat_v1 behavioral1/memory/3264-13-0x00000000009E0000-0x0000000000BC6000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation RubyWave - warface AI.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation Runtimeperfdhcp.exe -
Executes dropped EXE 2 IoCs
pid Process 3264 Runtimeperfdhcp.exe 4900 StartMenuExperienceHost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe Runtimeperfdhcp.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\55b276f4edf653 Runtimeperfdhcp.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\Programs\fontdrvhost.exe Runtimeperfdhcp.exe File created C:\Windows\appcompat\Programs\5b884080fd4f94 Runtimeperfdhcp.exe File created C:\Windows\appcompat\Programs\fontdrvhost.exe Runtimeperfdhcp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings RubyWave - warface AI.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings Runtimeperfdhcp.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4492 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe 3264 Runtimeperfdhcp.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4900 StartMenuExperienceHost.exe 4492 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3264 Runtimeperfdhcp.exe Token: SeDebugPrivilege 4900 StartMenuExperienceHost.exe Token: SeDebugPrivilege 4492 taskmgr.exe Token: SeSystemProfilePrivilege 4492 taskmgr.exe Token: SeCreateGlobalPrivilege 4492 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2548 1984 RubyWave - warface AI.exe 82 PID 1984 wrote to memory of 2548 1984 RubyWave - warface AI.exe 82 PID 1984 wrote to memory of 2548 1984 RubyWave - warface AI.exe 82 PID 2548 wrote to memory of 4584 2548 WScript.exe 86 PID 2548 wrote to memory of 4584 2548 WScript.exe 86 PID 2548 wrote to memory of 4584 2548 WScript.exe 86 PID 4584 wrote to memory of 3264 4584 cmd.exe 88 PID 4584 wrote to memory of 3264 4584 cmd.exe 88 PID 3264 wrote to memory of 4616 3264 Runtimeperfdhcp.exe 92 PID 3264 wrote to memory of 4616 3264 Runtimeperfdhcp.exe 92 PID 4616 wrote to memory of 3016 4616 cmd.exe 94 PID 4616 wrote to memory of 3016 4616 cmd.exe 94 PID 4616 wrote to memory of 4492 4616 cmd.exe 95 PID 4616 wrote to memory of 4492 4616 cmd.exe 95 PID 4616 wrote to memory of 4900 4616 cmd.exe 101 PID 4616 wrote to memory of 4900 4616 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\RubyWave - warface AI.exe"C:\Users\Admin\AppData\Local\Temp\RubyWave - warface AI.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hyperchainWebSavesHost\C3oHAXCjllIjyA4thIc5NSBg8yvnq.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\hyperchainWebSavesHost\BHs6uvIkOQOMGM2Zpb6kJ4ur82VMB.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\hyperchainWebSavesHost\Runtimeperfdhcp.exe"C:\hyperchainWebSavesHost/Runtimeperfdhcp.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m8QYGlPFMr.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\system32\chcp.comchcp 650016⤵PID:3016
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
PID:4492
-
-
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209B
MD5f41e96f5359ba771bd40470e40ce7c19
SHA13efaf5dbd9c37bf8b8b6d3c354695a3520d9f7ee
SHA256b75038102cc6f1f342aefa43d7664926648110c327526d82aac7c6c0bfbe30f1
SHA5127c93a21aef896bde29ad1e7bc5ec8944e4662c6b5930611efdf0075a69c9d5841c528acddfd6b4336b123a4e7688e356630f377dc87cfbfbd96cc458048fee4a
-
Filesize
89B
MD5992551141d99f529c430090564431322
SHA1df5ff7e5363c390c20df042911be2b74b7dc4e89
SHA256b91b1e34f6961b454449cdf1255b1079979932c503d35f0c89420337e3096f06
SHA512d6200f4391d10f7c0592aea529463c93b32f70fd9bde4c469e7e50f3e195777126e5aeb498336340c4a55490fca1c8501b7129a560ff62f83c643a8c69e42a68
-
Filesize
229B
MD5b6277c585f3f9bce431ddc0bcf3e8345
SHA16bd292b0ea94285fb8d02bcc663b8f8caba12c1c
SHA2568256503ea1b4ae6f1914eb5a13921b3fd6fd778eb2a8229fadfa6d07a03d91c9
SHA512b405ad2970a48677aa8e7df85c0ceb2b8396b3552ce6f482b54a58f24805269ae20055909fa0e8c095d1ea0d7546b5462b57a32c6786ae93935796a36f124e72
-
Filesize
1.9MB
MD59d8553ed1a60b8d1675f7669d0ec6bb2
SHA10d118ea90a509176f87b68c42e7d63f27393190e
SHA25647f3e8f21bb8c1f7739e7f2199989356111105782b3e7e0b6fd6922d5f717e0a
SHA512c686ef951974d4852e93b2a8754b7e9a104a17ed6289e6439e16b96c8824db4b0d80676fa712d1acdbde2f31a8e0f1f6adc8e7af2762bce0fd8f3185d2f1a332