Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 10:21
Static task
static1
Behavioral task
behavioral1
Sample
4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe
Resource
win10v2004-20240508-en
General
-
Target
4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe
-
Size
2.2MB
-
MD5
e2fc229dbf8224232d5281b1b9c12aca
-
SHA1
36c57d932bff9db9c221911fcc676f00c21cf4e6
-
SHA256
4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60
-
SHA512
95d1e3383445210e4cc4574baf7fcd68fb68099f202534108a5120ce776f93b777d112a0175ee41ad5e91b18bddc864ebb89fe7c8817769c3fd16762f1e2a27b
-
SSDEEP
12288:hw3Pj/+DfNCKml36Ych32o0Fcmr/bXrKT9xiAJ65TTlBDa+zB2av:C3LsN8
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file 2 IoCs
Processes:
$wz$sd_nj$dvz.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat $wz$sd_nj$dvz.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start $wz$sd_nj$dvz.exe -
Executes dropped EXE 1 IoCs
Processes:
$wz$sd_nj$dvz.exepid process 2444 $wz$sd_nj$dvz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 2 IoCs
Processes:
$wz$sd_nj$dvz.exedescription ioc process File created C:\Users\Admin\Documents\Documents:ApplicationData $wz$sd_nj$dvz.exe File opened for modification C:\Users\Admin\Documents\Documents:ApplicationData $wz$sd_nj$dvz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exepowershell.exe$wz$sd_nj$dvz.exepid process 2204 4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe 2524 powershell.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe 2444 $wz$sd_nj$dvz.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2524 powershell.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe$wz$sd_nj$dvz.execmd.exedescription pid process target process PID 2204 wrote to memory of 2444 2204 4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe $wz$sd_nj$dvz.exe PID 2204 wrote to memory of 2444 2204 4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe $wz$sd_nj$dvz.exe PID 2204 wrote to memory of 2444 2204 4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe $wz$sd_nj$dvz.exe PID 2204 wrote to memory of 2444 2204 4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe $wz$sd_nj$dvz.exe PID 2204 wrote to memory of 2016 2204 4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe WerFault.exe PID 2204 wrote to memory of 2016 2204 4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe WerFault.exe PID 2204 wrote to memory of 2016 2204 4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe WerFault.exe PID 2444 wrote to memory of 2524 2444 $wz$sd_nj$dvz.exe powershell.exe PID 2444 wrote to memory of 2524 2444 $wz$sd_nj$dvz.exe powershell.exe PID 2444 wrote to memory of 2524 2444 $wz$sd_nj$dvz.exe powershell.exe PID 2444 wrote to memory of 2524 2444 $wz$sd_nj$dvz.exe powershell.exe PID 2444 wrote to memory of 2692 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 2692 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 2692 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 2692 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 2560 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 2560 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 2560 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 2560 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2692 wrote to memory of 2528 2692 cmd.exe reg.exe PID 2692 wrote to memory of 2528 2692 cmd.exe reg.exe PID 2692 wrote to memory of 2528 2692 cmd.exe reg.exe PID 2692 wrote to memory of 2528 2692 cmd.exe reg.exe PID 2444 wrote to memory of 2560 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 2560 2444 $wz$sd_nj$dvz.exe cmd.exe PID 2444 wrote to memory of 1192 2444 $wz$sd_nj$dvz.exe Explorer.EXE PID 2444 wrote to memory of 1192 2444 $wz$sd_nj$dvz.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe"C:\Users\Admin\AppData\Local\Temp\4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"3⤵
- Drops startup file
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"5⤵PID:2528
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:2560
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2204 -s 3283⤵PID:2016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5d18f0b30efd9f100f11f81825bae050b
SHA1eacd3786e86ee03b14300c2dc6a08e5cfa2406bf
SHA25673c15f93c957b337b30e6b6712487234738a3e0569611d3aac49896582f7b54c
SHA512e6987f4a553699e80b64217919a066eab2e2f81d13c6c4e53c0c5b423c17ac7f129b86b56512de2e45e21d840e0ba3629ffd6ed2aadb84d4ff19521371e00560