Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    27-10-2024 19:56

General

  • Target

    0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe

  • Size

    8.2MB

  • MD5

    97b7a0352464b16ebf2241e7eb8c08a4

  • SHA1

    c9b22e8d3f02f481600fa3ec6a652bbfde5eb2c5

  • SHA256

    0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be

  • SHA512

    76548bb04e9439bdf4d76c9ccc3880c1ef888de50dcacf2b70d5855045d70f22a7a095f8dde541cac67977ddde2de12bd0d8ebafc69385ffe18886f6d976603b

  • SSDEEP

    49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecR:V8e8e8f8e8e8Q

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe
    "C:\Users\Admin\AppData\Local\Temp\0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Users\Admin\AppData\Local\Temp\0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe
      "C:\Users\Admin\AppData\Local\Temp\0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2672
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2256
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1724
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1696
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2652
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2680
            • C:\Windows\SysWOW64\diskperf.exe
              "C:\Windows\SysWOW64\diskperf.exe"
              6⤵
                PID:484
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2240
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2412
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1984
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1480
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2076
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1712
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2016
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:916
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2352
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:3048
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2820
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:3028
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2896
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1012
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2632
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 36
                6⤵
                • Program crash
                PID:816
          • C:\Windows\SysWOW64\diskperf.exe
            "C:\Windows\SysWOW64\diskperf.exe"
            4⤵
              PID:2088
        • C:\Windows\SysWOW64\diskperf.exe
          "C:\Windows\SysWOW64\diskperf.exe"
          2⤵
            PID:2276

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

          Filesize

          8.2MB

          MD5

          97b7a0352464b16ebf2241e7eb8c08a4

          SHA1

          c9b22e8d3f02f481600fa3ec6a652bbfde5eb2c5

          SHA256

          0f52530f6dbe366263586096b2cfd34f31942f50a220e2d8e9636c54f5d6e7be

          SHA512

          76548bb04e9439bdf4d76c9ccc3880c1ef888de50dcacf2b70d5855045d70f22a7a095f8dde541cac67977ddde2de12bd0d8ebafc69385ffe18886f6d976603b

        • C:\Windows\system\explorer.exe

          Filesize

          8.2MB

          MD5

          fc95da5b3a379d29ae64b157873cea89

          SHA1

          0edcebcbfee217471c7fd1ef73d9eb4ce8a2f3d3

          SHA256

          64748f6e3284d0c6b94c7ba939b2656081a1e5fa9fe5abdbf4e87a0df36413be

          SHA512

          3d910a75a736c829f2165d8ee6d378854fd37c3f5157b2de8160bffbcdaac3dbe16b3b91a4e0347728c36b501ccae797d1ae234a3ac1dc4f99111cebfbaadead

        • \Windows\system\spoolsv.exe

          Filesize

          8.2MB

          MD5

          44c8cc577b4d2be4f8bee990db884c27

          SHA1

          1d4212954da89f5595b044b47cb88e9445ca204b

          SHA256

          97e5250c3d51755f257a33e53d3f5a4f1606df01e3cbcc3d36fd7408b9468d04

          SHA512

          b26289511603504d300b53c33ef9ff87795f5f25da668d06278928791b5826a752045b8acde23172e14c26a1d1a5c26d56e292f45e5b7b42a720b5cbf5a2556f

        • memory/1696-104-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1696-244-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1696-103-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1696-105-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1696-137-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1724-155-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/1724-170-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/1724-259-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1724-125-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1724-172-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/1724-115-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/1724-134-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/1724-145-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1724-101-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/1724-90-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1724-135-0x0000000003260000-0x0000000003374000-memory.dmp

          Filesize

          1.1MB

        • memory/2088-94-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2240-124-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2240-126-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2256-85-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2256-49-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2256-51-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2256-52-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2256-50-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2276-26-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2276-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2276-38-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2276-36-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2276-30-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2652-256-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2652-251-0x0000000003120000-0x0000000003234000-memory.dmp

          Filesize

          1.1MB

        • memory/2652-235-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2672-14-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2672-25-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2672-12-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2672-48-0x0000000003160000-0x0000000003274000-memory.dmp

          Filesize

          1.1MB

        • memory/2672-24-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2672-10-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2672-55-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2680-260-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2752-4-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2752-1-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2752-2-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2752-34-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2752-0-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2752-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB

        • memory/2752-6-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB