Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2024, 01:14

General

  • Target

    7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe

  • Size

    11.1MB

  • MD5

    63316fbe9cf350587c0ba8e107b72aeb

  • SHA1

    face0bdd6337c3f224dfd5a5088fcc821fd4f3eb

  • SHA256

    7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a

  • SHA512

    325136919dcaf134c81818bddfe678756b18f802344023b2dad98f139d845522e6d719e1d54b33ddfd31329d5efd96ff3c83b3af7c0964fe4280b04fc02a95e3

  • SSDEEP

    196608:A+GhzkE7l+GhzkE7H+GhzkE7p+GhzkE7D+GhzkE7d+GhzkE7T+GhzkE7fKWQc0gr:AxhzkUxhzkKxhzkoxhzkWxhzk8xhzkOT

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 7 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe
    "C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4544
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qCqbTEC.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qCqbTEC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBBAF.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2908
    • C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe
      "C:\Users\Admin\AppData\Local\Temp\7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Users\Admin\AppData\Local\Temp\._cache_7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2572
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4412
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:700
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qCqbTEC.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2152
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qCqbTEC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF741.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1816
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Executes dropped EXE
          PID:2068
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:544
          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3032
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    11.1MB

    MD5

    63316fbe9cf350587c0ba8e107b72aeb

    SHA1

    face0bdd6337c3f224dfd5a5088fcc821fd4f3eb

    SHA256

    7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a

    SHA512

    325136919dcaf134c81818bddfe678756b18f802344023b2dad98f139d845522e6d719e1d54b33ddfd31329d5efd96ff3c83b3af7c0964fe4280b04fc02a95e3

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    5294c6424d1927efa0667e33ec2f80a5

    SHA1

    7da36312137227289c69c315b4e96dfe508b65f1

    SHA256

    d364d9aa8eaf4333efe4f08cccf92a6c5f9662849b4c6b238cef903062cf794c

    SHA512

    53070f3d2fd93fa424dda05deea30ac7c423d61a54cbf8a23d8112fc444bccb89e7c583673b97d706dbc0bdd66c708034287a21a5429f9a413ffc54485782e83

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    5f5625e6628921cd610e790ab6e648c1

    SHA1

    4042e83da97908df153f9147fab4bd0633768c91

    SHA256

    256da638faf044538548b97b0de3d263af8e0c8e68c7abe880dd541a025b4051

    SHA512

    5554f97bb9db340ec174d8f760ca247be94a7d2acd8eded85fc0c91ebf78caa8c33e67e3256c124f3811380def6a9f4afc1b186eb674171675e5586a874234a0

  • C:\Users\Admin\AppData\Local\Temp\._cache_7ebbd7733c41e5d8d4071ac4bccca6f76577d8dda2ef2a6723b90414f444454a.exe

    Filesize

    132KB

    MD5

    b7d1a9faf64911bc6429be983d82668f

    SHA1

    09b5f838d19a2e82b86ec751bfe726e3d89b1017

    SHA256

    a1364f6fcb74ff76b1038e6c8871b23c1d5e2e28324bc365af512c04d791003c

    SHA512

    e5965d492bcf7da9a456ac4dc087a7164842d9d6ca6e359f67455341f979731e176db67f8e2734da4d4c141c36e78d26080a6b1cfb99b06b2b6a5f46182c86b1

  • C:\Users\Admin\AppData\Local\Temp\15085E00

    Filesize

    20KB

    MD5

    dd1bed33792113174c9be8c9ee6137b8

    SHA1

    456cbbe11b40681ce529a48e5d67cfdfc7abd714

    SHA256

    5d63ca715348db2e8a1e242d0d35e02e55eafce641b7bf27d9bd534d2e675021

    SHA512

    26afa9a1810a8c0feab702538c6a727892d1813d460e391a814854522b615232ea15e4e0b0ee6dbb7a37efb70079c82a25ddc7fc149736cecd7c534fd6d399a9

  • C:\Users\Admin\AppData\Local\Temp\6VdRpwCo.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jcscbua.ncc.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpBBAF.tmp

    Filesize

    1KB

    MD5

    f6faa0ecadb6546bc5e42586b66fd871

    SHA1

    dbabbf7a86cbf35244ddc62e30fd34d36513b459

    SHA256

    802f78c85207ee73bb3dbb99526b8037c832fa7ad0e8fbb65202e9391058ed4b

    SHA512

    a7cf4918909cf527d7a2acdf7a055410e8d78cdec58982313264c72e132fee10f940b03079c2c5ae97a490d7b99ac99d8e41cd8c73cd097bc4fb1c40f387ed8a

  • memory/544-332-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/544-331-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/544-336-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/544-360-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/700-203-0x0000000005EC0000-0x0000000006214000-memory.dmp

    Filesize

    3.3MB

  • memory/700-263-0x0000000007580000-0x0000000007623000-memory.dmp

    Filesize

    652KB

  • memory/700-253-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

    Filesize

    304KB

  • memory/1372-38-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/1372-36-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/1520-276-0x00007FFDE4850000-0x00007FFDE4860000-memory.dmp

    Filesize

    64KB

  • memory/1520-277-0x00007FFDE4850000-0x00007FFDE4860000-memory.dmp

    Filesize

    64KB

  • memory/1520-275-0x00007FFDE4850000-0x00007FFDE4860000-memory.dmp

    Filesize

    64KB

  • memory/1520-274-0x00007FFDE4850000-0x00007FFDE4860000-memory.dmp

    Filesize

    64KB

  • memory/1520-278-0x00007FFDE4850000-0x00007FFDE4860000-memory.dmp

    Filesize

    64KB

  • memory/1520-279-0x00007FFDE25F0000-0x00007FFDE2600000-memory.dmp

    Filesize

    64KB

  • memory/1520-281-0x00007FFDE25F0000-0x00007FFDE2600000-memory.dmp

    Filesize

    64KB

  • memory/2008-22-0x0000000005480000-0x00000000054A2000-memory.dmp

    Filesize

    136KB

  • memory/2008-182-0x0000000007890000-0x00000000078A4000-memory.dmp

    Filesize

    80KB

  • memory/2008-34-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/2008-39-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/2008-35-0x0000000005F20000-0x0000000006274000-memory.dmp

    Filesize

    3.3MB

  • memory/2008-77-0x0000000006320000-0x000000000633E000-memory.dmp

    Filesize

    120KB

  • memory/2008-78-0x00000000068A0000-0x00000000068EC000-memory.dmp

    Filesize

    304KB

  • memory/2008-187-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/2008-153-0x00000000068F0000-0x0000000006922000-memory.dmp

    Filesize

    200KB

  • memory/2008-154-0x0000000070A20000-0x0000000070A6C000-memory.dmp

    Filesize

    304KB

  • memory/2008-164-0x0000000007500000-0x000000000751E000-memory.dmp

    Filesize

    120KB

  • memory/2008-165-0x0000000007520000-0x00000000075C3000-memory.dmp

    Filesize

    652KB

  • memory/2008-20-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/2008-167-0x0000000007650000-0x000000000766A000-memory.dmp

    Filesize

    104KB

  • memory/2008-166-0x0000000007C90000-0x000000000830A000-memory.dmp

    Filesize

    6.5MB

  • memory/2008-178-0x00000000076C0000-0x00000000076CA000-memory.dmp

    Filesize

    40KB

  • memory/2008-179-0x00000000078D0000-0x0000000007966000-memory.dmp

    Filesize

    600KB

  • memory/2008-180-0x0000000007850000-0x0000000007861000-memory.dmp

    Filesize

    68KB

  • memory/2008-181-0x0000000007880000-0x000000000788E000-memory.dmp

    Filesize

    56KB

  • memory/2008-184-0x0000000007970000-0x0000000007978000-memory.dmp

    Filesize

    32KB

  • memory/2008-183-0x0000000007990000-0x00000000079AA000-memory.dmp

    Filesize

    104KB

  • memory/2152-245-0x0000000006860000-0x00000000068AC000-memory.dmp

    Filesize

    304KB

  • memory/2152-264-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

    Filesize

    304KB

  • memory/2152-280-0x0000000007D50000-0x0000000007D61000-memory.dmp

    Filesize

    68KB

  • memory/2152-282-0x0000000007D90000-0x0000000007DA4000-memory.dmp

    Filesize

    80KB

  • memory/4544-29-0x0000000005AE0000-0x0000000005B46000-memory.dmp

    Filesize

    408KB

  • memory/4544-37-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/4544-191-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/4544-168-0x0000000070A20000-0x0000000070A6C000-memory.dmp

    Filesize

    304KB

  • memory/4544-19-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/4544-28-0x00000000053B0000-0x0000000005416000-memory.dmp

    Filesize

    408KB

  • memory/4544-18-0x0000000005470000-0x0000000005A98000-memory.dmp

    Filesize

    6.2MB

  • memory/4544-17-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/4544-16-0x00000000029C0000-0x00000000029F6000-memory.dmp

    Filesize

    216KB

  • memory/4788-9-0x0000000005A20000-0x0000000005A30000-memory.dmp

    Filesize

    64KB

  • memory/4788-10-0x00000000070C0000-0x00000000071E6000-memory.dmp

    Filesize

    1.1MB

  • memory/4788-0-0x000000007525E000-0x000000007525F000-memory.dmp

    Filesize

    4KB

  • memory/4788-52-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/4788-8-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/4788-11-0x0000000006E50000-0x0000000006EEC000-memory.dmp

    Filesize

    624KB

  • memory/4788-7-0x000000007525E000-0x000000007525F000-memory.dmp

    Filesize

    4KB

  • memory/4788-6-0x0000000005A10000-0x0000000005A22000-memory.dmp

    Filesize

    72KB

  • memory/4788-5-0x0000000005950000-0x000000000595A000-memory.dmp

    Filesize

    40KB

  • memory/4788-4-0x0000000075250000-0x0000000075A00000-memory.dmp

    Filesize

    7.7MB

  • memory/4788-3-0x00000000057B0000-0x0000000005842000-memory.dmp

    Filesize

    584KB

  • memory/4788-2-0x0000000005CC0000-0x0000000006264000-memory.dmp

    Filesize

    5.6MB

  • memory/4788-1-0x00000000003F0000-0x0000000000F08000-memory.dmp

    Filesize

    11.1MB