Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
12s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 15:21
Behavioral task
behavioral1
Sample
2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe
Resource
win10v2004-20241007-en
General
-
Target
2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe
-
Size
132KB
-
MD5
2513cffce280a80414825a1bd6232883
-
SHA1
4534a043b96d31fcf6e79bf857db5ccffac31768
-
SHA256
2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b
-
SHA512
d65191709cd290256ba426c856cc7a7fa7cc2579458116f822a575681fe4117c97a91b088f8a19ba2352cacc7ab33cd7076ad13c55f8f3ec3d82b21e637028f9
-
SSDEEP
3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
Malware Config
Extracted
warzonerat
142.202.242.177:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0009000000016cfc-12.dat warzonerat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2016 powershell.exe 2764 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe -
Executes dropped EXE 1 IoCs
pid Process 2736 images.exe -
Loads dropped DLL 2 IoCs
pid Process 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\images.exe" 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Documents\Documents:ApplicationData 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2016 powershell.exe 2764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 2764 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2016 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 30 PID 2096 wrote to memory of 2016 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 30 PID 2096 wrote to memory of 2016 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 30 PID 2096 wrote to memory of 2016 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 30 PID 2096 wrote to memory of 2736 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 32 PID 2096 wrote to memory of 2736 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 32 PID 2096 wrote to memory of 2736 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 32 PID 2096 wrote to memory of 2736 2096 2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe 32 PID 2736 wrote to memory of 2764 2736 images.exe 33 PID 2736 wrote to memory of 2764 2736 images.exe 33 PID 2736 wrote to memory of 2764 2736 images.exe 33 PID 2736 wrote to memory of 2764 2736 images.exe 33 PID 2736 wrote to memory of 2808 2736 images.exe 35 PID 2736 wrote to memory of 2808 2736 images.exe 35 PID 2736 wrote to memory of 2808 2736 images.exe 35 PID 2736 wrote to memory of 2808 2736 images.exe 35 PID 2736 wrote to memory of 2808 2736 images.exe 35 PID 2736 wrote to memory of 2808 2736 images.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe"C:\Users\Admin\AppData\Local\Temp\2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD523cd1e0c83db37c918df1d73ba4e7448
SHA1724069b440080c3e6acd7d398703f8dbbabf68d6
SHA256dff51285d6fda156709e0e545b777f29bb79bba7d2930941c5cc249f12807613
SHA5124f3a7a57318e6c57232b823105b904a1634fd2d5abe57ba51bb059db4498bb1566e19ff64b8532bd6f62b7475add4f5a78f44a85444ca84167638cc3abd7a088
-
Filesize
132KB
MD52513cffce280a80414825a1bd6232883
SHA14534a043b96d31fcf6e79bf857db5ccffac31768
SHA2562769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b
SHA512d65191709cd290256ba426c856cc7a7fa7cc2579458116f822a575681fe4117c97a91b088f8a19ba2352cacc7ab33cd7076ad13c55f8f3ec3d82b21e637028f9