Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-10-2024 02:51

General

  • Target

    fdbfec821ce43125f7e1108bfb22bab9a6e52af0dbc1b7abb08f15daf2fd8583.exe

  • Size

    3.9MB

  • MD5

    5309c3f6de55185dedb1c353afa27c80

  • SHA1

    d181c03c655ad31440248ebb398a91c35defed39

  • SHA256

    fdbfec821ce43125f7e1108bfb22bab9a6e52af0dbc1b7abb08f15daf2fd8583

  • SHA512

    0c10ac905296f1a360c2d48b13669bc9dd6f3c1d4e7b8bce495e29e69c137204bcf946935336629b14a539c782320e995313bba2c59af31b350f810bcda6dca9

  • SSDEEP

    24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDW:7C0bNechC0bNechC0bNecO

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdbfec821ce43125f7e1108bfb22bab9a6e52af0dbc1b7abb08f15daf2fd8583.exe
    "C:\Users\Admin\AppData\Local\Temp\fdbfec821ce43125f7e1108bfb22bab9a6e52af0dbc1b7abb08f15daf2fd8583.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Local\Temp\fdbfec821ce43125f7e1108bfb22bab9a6e52af0dbc1b7abb08f15daf2fd8583.exe
      "C:\Users\Admin\AppData\Local\Temp\fdbfec821ce43125f7e1108bfb22bab9a6e52af0dbc1b7abb08f15daf2fd8583.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2748
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2728
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2272
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1880
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3000
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2820
            • C:\Windows\SysWOW64\diskperf.exe
              "C:\Windows\SysWOW64\diskperf.exe"
              6⤵
                PID:2700
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1620
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2596
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2524
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2640
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2516
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1592
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1320
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1916
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1536
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:904
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2624
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2808
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:900
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2176
          • C:\Windows\SysWOW64\diskperf.exe
            "C:\Windows\SysWOW64\diskperf.exe"
            4⤵
              PID:2324
        • C:\Windows\SysWOW64\diskperf.exe
          "C:\Windows\SysWOW64\diskperf.exe"
          2⤵
            PID:2660

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

          Filesize

          3.9MB

          MD5

          5309c3f6de55185dedb1c353afa27c80

          SHA1

          d181c03c655ad31440248ebb398a91c35defed39

          SHA256

          fdbfec821ce43125f7e1108bfb22bab9a6e52af0dbc1b7abb08f15daf2fd8583

          SHA512

          0c10ac905296f1a360c2d48b13669bc9dd6f3c1d4e7b8bce495e29e69c137204bcf946935336629b14a539c782320e995313bba2c59af31b350f810bcda6dca9

        • C:\Windows\system\explorer.exe

          Filesize

          3.9MB

          MD5

          c0080be79f2368cbec76e0c52cf51783

          SHA1

          d15e22ca9f9b00f3b99f303318fc71989b323ff9

          SHA256

          94301ce1cf4ab7345e6f58959ec8b68cad67180524998f2e5c59565b36f5c291

          SHA512

          13ddbd0cde5fc685f3df65de5fd5e019f777bebaef161b04a845bddf9eaf005533c5d83db1d5b90ad5321a6255231773b8d312b4c07745b05ed616195eb53f43

        • \Windows\system\spoolsv.exe

          Filesize

          3.9MB

          MD5

          bde1f81c25a1793989744fc6f84cc06a

          SHA1

          00264c5dde29cc9b84b16a84bec1463a8072b29a

          SHA256

          158be9206c4ced0752e8ad3fa1f1ff3f9cc0f089e8e1cdc681a199c0daef5497

          SHA512

          718b4a770860c306287be5b6b58f3551b21b9d7807c09690f6b1d7f5eb06ca2b1f2d2845601e36aa4099cf6edeb6f183f845a11af3c6c917e2d2e2215edb8120

        • memory/1536-193-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1620-128-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1620-116-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1880-103-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1880-242-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1880-104-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1880-126-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-0-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-22-0x00000000030D0000-0x00000000031E4000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-6-0x0000000000360000-0x0000000000361000-memory.dmp

          Filesize

          4KB

        • memory/2196-4-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-3-0x0000000000360000-0x0000000000361000-memory.dmp

          Filesize

          4KB

        • memory/2196-1-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-38-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-2-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-137-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-127-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-138-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-125-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-124-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2272-114-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-136-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-148-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2272-158-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-157-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-102-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2272-260-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2324-89-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2324-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2516-160-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2524-140-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2660-40-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2660-32-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2660-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2660-28-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2660-39-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2728-54-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2728-57-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2728-52-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2728-88-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2728-53-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2728-55-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2748-24-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2748-56-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2748-12-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2748-50-0x00000000032D0000-0x00000000033E4000-memory.dmp

          Filesize

          1.1MB

        • memory/2748-27-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2748-14-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2748-10-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2820-250-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2820-258-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/3000-234-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3000-251-0x0000000003240000-0x0000000003354000-memory.dmp

          Filesize

          1.1MB

        • memory/3000-256-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB