Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2024, 01:14

General

  • Target

    7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe

  • Size

    11.1MB

  • MD5

    63316fbe9cf350587c0ba8e107b72aeb

  • SHA1

    face0bdd6337c3f224dfd5a5088fcc821fd4f3eb

  • SHA256

    7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a

  • SHA512

    325136919dcaf134c81818bddfe678756b18f802344023b2dad98f139d845522e6d719e1d54b33ddfd31329d5efd96ff3c83b3af7c0964fe4280b04fc02a95e3

  • SSDEEP

    196608:A+GhzkE7l+GhzkE7H+GhzkE7p+GhzkE7D+GhzkE7d+GhzkE7T+GhzkE7fKWQc0gr:AxhzkUxhzkKxhzkoxhzkWxhzk8xhzkOT

Malware Config

Extracted

Family

warzonerat

C2

victorybelng.ddns.net:13900

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe
    "C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1720
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qCqbTEC.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qCqbTEC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp10B3.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2788
    • C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe
      "C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
      2⤵
        PID:2564
      • C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe
        "C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Users\Admin\AppData\Local\Temp\._cache_7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2712
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3000
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1944
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qCqbTEC.exe"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2416
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qCqbTEC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4672.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2120
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2032
            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:300
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      11.1MB

      MD5

      63316fbe9cf350587c0ba8e107b72aeb

      SHA1

      face0bdd6337c3f224dfd5a5088fcc821fd4f3eb

      SHA256

      7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a

      SHA512

      325136919dcaf134c81818bddfe678756b18f802344023b2dad98f139d845522e6d719e1d54b33ddfd31329d5efd96ff3c83b3af7c0964fe4280b04fc02a95e3

    • C:\Users\Admin\AppData\Local\Temp\D8StuoEe.xlsm

      Filesize

      23KB

      MD5

      3920f01f4dbd538a589d36b99fcc6107

      SHA1

      a0b6d0171ac10fc5b8a104cfb366d865756a2430

      SHA256

      1bc1b4778afde883026b15da2ae6936442b9c230b4cb18937fc05ab0ce272f19

      SHA512

      111a8b6fabf9eb8f9f2b9c0f120fe963f09c66239d6f49c7964d722ad36d82a1df813723ace18728687b9049ccf81b3d38f23cd51faa40ece0915bfe4af28022

    • C:\Users\Admin\AppData\Local\Temp\D8StuoEe.xlsm

      Filesize

      30KB

      MD5

      26b2a937500fe54402a78aa5e0592d8c

      SHA1

      cf9586be2c8635c79689acf488473bc8691ccef0

      SHA256

      9a85a4908acdfaed035d64eb00026547e33399b089391eac2195bbe4706cb828

      SHA512

      ede9ef6adee4aadd13a4f14cc10f72716f11bd5a5007ae841ad63c64b60ec447d4b2d1f556f2256f5778484234057549ab158837f85619a6e2f9db85d4394828

    • C:\Users\Admin\AppData\Local\Temp\D8StuoEe.xlsm

      Filesize

      25KB

      MD5

      a15f984b50161d7b7755e9fe2c539ccc

      SHA1

      73575b7b91537d3de2e9b8bdea0196551b99e354

      SHA256

      653fe80878df82fdc34470bbf20d7c88b7bc31c81b97f1c196ef301f0583e349

      SHA512

      02825aebc5fd1ad1786cc677ecb2fede64eb402c2b78d360c653eedfb69458c7be5567a173c4b61c4175663559ffe34dad9f3e12a4f79c9138dad84317d5a1d2

    • C:\Users\Admin\AppData\Local\Temp\D8StuoEe.xlsm

      Filesize

      17KB

      MD5

      e566fc53051035e1e6fd0ed1823de0f9

      SHA1

      00bc96c48b98676ecd67e81a6f1d7754e4156044

      SHA256

      8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

      SHA512

      a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    • C:\Users\Admin\AppData\Local\Temp\tmp10B3.tmp

      Filesize

      1KB

      MD5

      a3ad53388bec47f258d3a5060ffdfa0b

      SHA1

      0f89c7abfecb8a851b73717c8237cde813b04fb9

      SHA256

      b7e043e2e6e14b88812dd2603391deb4392b1132e1394264b813d9e6624cd5de

      SHA512

      f38e308b9b44c19cf785610eb44043449521888b26eecd214835792b47d08f68899f314a4dc3645ef927831b10443eac562f62d37c996f1ee673d009933ff7ff

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      4289347cd77f79f270aa139e55c4f5f5

      SHA1

      65fb9f2498001d95b34a527561501244457a8e43

      SHA256

      3bd4a5fedb924f34f79c10319a85c04f3bb0026217d34566a07d530a7e9a35a6

      SHA512

      7c2080fb1a3f5e38c77e494bc984e8e57046634fa7291db08b0a07201903b8f3cf5d8ac60e8f469e23131448fd674e4080cf0eb476f49268841f1adaa099db34

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      3b4c3ef93fa0151063d3f11c7773a7d2

      SHA1

      8bff1cdae1e86f111a716ee1185ca3e53610c87f

      SHA256

      7b864b07148b0a7d996f892eb33e1e9fd54ce6fd6fea5324460da967483a4f99

      SHA512

      360623ec94e58096f1a6213e3683131a53d795ca7a59d8910f8c49552456fb8b28eb00f26bbcf4f38756ff3e06e6fb941addc300f4309968cc6425b3a3b42fbd

    • \Users\Admin\AppData\Local\Temp\._cache_7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe

      Filesize

      132KB

      MD5

      b7d1a9faf64911bc6429be983d82668f

      SHA1

      09b5f838d19a2e82b86ec751bfe726e3d89b1017

      SHA256

      a1364f6fcb74ff76b1038e6c8871b23c1d5e2e28324bc365af512c04d791003c

      SHA512

      e5965d492bcf7da9a456ac4dc087a7164842d9d6ca6e359f67455341f979731e176db67f8e2734da4d4c141c36e78d26080a6b1cfb99b06b2b6a5f46182c86b1

    • memory/1172-39-0x0000000074370000-0x0000000074A5E000-memory.dmp

      Filesize

      6.9MB

    • memory/1172-7-0x0000000006110000-0x0000000006236000-memory.dmp

      Filesize

      1.1MB

    • memory/1172-6-0x0000000000620000-0x0000000000630000-memory.dmp

      Filesize

      64KB

    • memory/1172-5-0x0000000074370000-0x0000000074A5E000-memory.dmp

      Filesize

      6.9MB

    • memory/1172-4-0x000000007437E000-0x000000007437F000-memory.dmp

      Filesize

      4KB

    • memory/1172-3-0x0000000000610000-0x0000000000622000-memory.dmp

      Filesize

      72KB

    • memory/1172-0-0x000000007437E000-0x000000007437F000-memory.dmp

      Filesize

      4KB

    • memory/1172-2-0x0000000074370000-0x0000000074A5E000-memory.dmp

      Filesize

      6.9MB

    • memory/1172-1-0x0000000001390000-0x0000000001EA8000-memory.dmp

      Filesize

      11.1MB

    • memory/1356-110-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1356-175-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2032-97-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2032-204-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2032-176-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2032-174-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2032-173-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2032-94-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2924-23-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2924-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2924-20-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2924-35-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2924-25-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2924-26-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2924-32-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2924-36-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2924-30-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/2924-28-0x0000000000400000-0x00000000004E3000-memory.dmp

      Filesize

      908KB

    • memory/3000-66-0x0000000000850000-0x0000000001368000-memory.dmp

      Filesize

      11.1MB