Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2024, 20:50

General

  • Target

    46d5190fd7f6dc29f452951eeeacfff33677d3b620da637b2cba73514b7f1d3c.xll

  • Size

    1.0MB

  • MD5

    fda6f5316adb00c79ae1eb52f51a92a1

  • SHA1

    a6333318d5b16abaa1c87da084a7175503e35485

  • SHA256

    46d5190fd7f6dc29f452951eeeacfff33677d3b620da637b2cba73514b7f1d3c

  • SHA512

    f415a108bcb5d1541ecf897c5c53570f70bd01598c3e4e926d43b75f9b9edea6b096c1354286f522201dc50feacf43a3143e095e6630e0896cc07957edee8625

  • SSDEEP

    24576:qoOOMX1P+QHT+dOVV/kV+IdxriUJ/Qaaep:qoOOq+QHsOVV/kVbTNRfR

Malware Config

Extracted

Family

warzonerat

C2

qoldwold.zanity.net:5208

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 3 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\46d5190fd7f6dc29f452951eeeacfff33677d3b620da637b2cba73514b7f1d3c.xll"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Users\Admin\AppData\Local\Temp\523cf743-1d5c-4053-9cc4-028dfaadbea6.exe
      "C:\Users\Admin\AppData\Local\Temp\523cf743-1d5c-4053-9cc4-028dfaadbea6.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Users\Admin\AppData\Local\Temp\523cf743-1d5c-4053-9cc4-028dfaadbea6.exe
        C:\Users\Admin\AppData\Local\Temp\523cf743-1d5c-4053-9cc4-028dfaadbea6.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5104
        • C:\ProgramData\cmages.exe
          "C:\ProgramData\cmages.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4376
          • C:\ProgramData\cmages.exe
            C:\ProgramData\cmages.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4280
          • C:\ProgramData\cmages.exe
            C:\ProgramData\cmages.exe
            5⤵
            • Executes dropped EXE
            PID:3216
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 80
              6⤵
              • Program crash
              PID:3808
      • C:\Users\Admin\AppData\Local\Temp\523cf743-1d5c-4053-9cc4-028dfaadbea6.exe
        C:\Users\Admin\AppData\Local\Temp\523cf743-1d5c-4053-9cc4-028dfaadbea6.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1144
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3216 -ip 3216
    1⤵
      PID:4788

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\46d5190fd7f6dc29f452951eeeacfff33677d3b620da637b2cba73514b7f1d3c.xll

      Filesize

      1.0MB

      MD5

      fda6f5316adb00c79ae1eb52f51a92a1

      SHA1

      a6333318d5b16abaa1c87da084a7175503e35485

      SHA256

      46d5190fd7f6dc29f452951eeeacfff33677d3b620da637b2cba73514b7f1d3c

      SHA512

      f415a108bcb5d1541ecf897c5c53570f70bd01598c3e4e926d43b75f9b9edea6b096c1354286f522201dc50feacf43a3143e095e6630e0896cc07957edee8625

    • C:\Users\Admin\AppData\Local\Temp\523cf743-1d5c-4053-9cc4-028dfaadbea6.exe

      Filesize

      488KB

      MD5

      4be82778811dcb6fe8637808dedeefbb

      SHA1

      2c4ea159d73c849f9d1912110170842343188a2e

      SHA256

      cd50bd011e077a8fb6003945c35bb75a32ef16b6a99bfb0d5c7a2e3fabf25f68

      SHA512

      ad047aba2bf6e7c6b8f31d5754b21266c81c994f7a926239f46120fc5b57e8cff84f671b20022f3e7866ae0b9a3ed119de3342856fc05747a09f1790498b6854

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      2KB

      MD5

      b3785ef580ec8a2e5afb375bd67a7418

      SHA1

      7d6a3b437d63f1ccb8d5f34a0a0508b2207fb62f

      SHA256

      923860e2baa25186284697f8c5dc0df8bc5236ebbbde2fab0e1194212729ba61

      SHA512

      efb97e6d4e3efa0f2bebe5500728bf165b0fd0f5cdbb3a091dd86efda44a3e4d979bcdd06be116e775eb92922bd0456490da2c090c8dc6d2922ab2ee7ffef733

    • memory/1144-68-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2036-59-0x0000000005C20000-0x0000000005CBC000-memory.dmp

      Filesize

      624KB

    • memory/2036-60-0x0000000006270000-0x0000000006814000-memory.dmp

      Filesize

      5.6MB

    • memory/2036-61-0x0000000005CC0000-0x0000000005D52000-memory.dmp

      Filesize

      584KB

    • memory/2036-58-0x0000000005860000-0x00000000058DA000-memory.dmp

      Filesize

      488KB

    • memory/2036-57-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/2036-55-0x0000000003240000-0x0000000003246000-memory.dmp

      Filesize

      24KB

    • memory/2036-54-0x0000000000FE0000-0x0000000001064000-memory.dmp

      Filesize

      528KB

    • memory/2036-53-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/2036-62-0x0000000005BF0000-0x0000000005BF6000-memory.dmp

      Filesize

      24KB

    • memory/4144-7-0x00007FFB074D0000-0x00007FFB074E0000-memory.dmp

      Filesize

      64KB

    • memory/4144-8-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-16-0x00007FFB04E40000-0x00007FFB04E50000-memory.dmp

      Filesize

      64KB

    • memory/4144-0-0x00007FFB074D0000-0x00007FFB074E0000-memory.dmp

      Filesize

      64KB

    • memory/4144-19-0x000002C817230000-0x000002C817353000-memory.dmp

      Filesize

      1.1MB

    • memory/4144-22-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-25-0x000002C831BE0000-0x000002C831D64000-memory.dmp

      Filesize

      1.5MB

    • memory/4144-28-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-27-0x000002C8187F0000-0x000002C81882C000-memory.dmp

      Filesize

      240KB

    • memory/4144-26-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-24-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-23-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-21-0x000002C8187B0000-0x000002C8187C4000-memory.dmp

      Filesize

      80KB

    • memory/4144-20-0x000002C8187B0000-0x000002C8187C4000-memory.dmp

      Filesize

      80KB

    • memory/4144-35-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-36-0x000002C818B10000-0x000002C818B94000-memory.dmp

      Filesize

      528KB

    • memory/4144-34-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-13-0x00007FFB04E40000-0x00007FFB04E50000-memory.dmp

      Filesize

      64KB

    • memory/4144-14-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-4-0x00007FFB074D0000-0x00007FFB074E0000-memory.dmp

      Filesize

      64KB

    • memory/4144-12-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-56-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-9-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-10-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-11-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-5-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-6-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-2-0x00007FFB074D0000-0x00007FFB074E0000-memory.dmp

      Filesize

      64KB

    • memory/4144-3-0x00007FFB074D0000-0x00007FFB074E0000-memory.dmp

      Filesize

      64KB

    • memory/4144-1-0x00007FFB474ED000-0x00007FFB474EE000-memory.dmp

      Filesize

      4KB

    • memory/4144-70-0x00007FFB474ED000-0x00007FFB474EE000-memory.dmp

      Filesize

      4KB

    • memory/4144-71-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-85-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-81-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-82-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-83-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4144-84-0x00007FFB47450000-0x00007FFB47645000-memory.dmp

      Filesize

      2.0MB

    • memory/4280-78-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/5104-63-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB