Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2024 14:08
Static task
static1
Behavioral task
behavioral1
Sample
EzFN-Manager.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
EzFN-Manager.exe
Resource
win10v2004-20241007-en
General
-
Target
EzFN-Manager.exe
-
Size
10.5MB
-
MD5
e528490c86b7bbd42cee5eb2ec1dcaa0
-
SHA1
758ea1f40317648d9c0eb6f3540158bdbc1860a4
-
SHA256
a5b3e8a7c2cace998612199ffdfda738d3107ebafc810219c1a648467cefcb05
-
SHA512
fce546b12944c6b08c016532a6f49fdb5d45412025de2600a59079f29323bb2732d756f802999a3fb46e84e52dd93c1c2acdde59a9feaf102546455976f41863
-
SSDEEP
196608:HxmZUWfcvgWCpS1rpAcfBSOfMJiNbguUhFk7668rH55oHG:HwG0WCyrpAcfzf9bgT4xc5+G
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinRAR.exe warzonerat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 4436 powershell.exe 1872 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
EzFN-Manager.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation EzFN-Manager.exe -
Executes dropped EXE 3 IoCs
Processes:
EzFN-Manager.exeWinRAR.exeWinRAR.exepid process 3672 EzFN-Manager.exe 4028 WinRAR.exe 4812 WinRAR.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
EzFN-Manager.exeWinRAR.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" EzFN-Manager.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinRAR = "C:\\Users\\Admin\\Documents\\WinRAR.exe" WinRAR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
WinRAR.exepowershell.execmd.exeWinRAR.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinRAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinRAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1872 powershell.exe 1872 powershell.exe 4436 powershell.exe 4436 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
EzFN-Manager.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3672 EzFN-Manager.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeDebugPrivilege 4436 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
EzFN-Manager.exeEzFN-Manager.exeWinRAR.exeWinRAR.exedescription pid process target process PID 1316 wrote to memory of 3672 1316 EzFN-Manager.exe EzFN-Manager.exe PID 1316 wrote to memory of 3672 1316 EzFN-Manager.exe EzFN-Manager.exe PID 1316 wrote to memory of 4028 1316 EzFN-Manager.exe WinRAR.exe PID 1316 wrote to memory of 4028 1316 EzFN-Manager.exe WinRAR.exe PID 1316 wrote to memory of 4028 1316 EzFN-Manager.exe WinRAR.exe PID 3672 wrote to memory of 1376 3672 EzFN-Manager.exe attrib.exe PID 3672 wrote to memory of 1376 3672 EzFN-Manager.exe attrib.exe PID 4028 wrote to memory of 1872 4028 WinRAR.exe powershell.exe PID 4028 wrote to memory of 1872 4028 WinRAR.exe powershell.exe PID 4028 wrote to memory of 1872 4028 WinRAR.exe powershell.exe PID 4028 wrote to memory of 4812 4028 WinRAR.exe WinRAR.exe PID 4028 wrote to memory of 4812 4028 WinRAR.exe WinRAR.exe PID 4028 wrote to memory of 4812 4028 WinRAR.exe WinRAR.exe PID 4812 wrote to memory of 4436 4812 WinRAR.exe powershell.exe PID 4812 wrote to memory of 4436 4812 WinRAR.exe powershell.exe PID 4812 wrote to memory of 4436 4812 WinRAR.exe powershell.exe PID 4812 wrote to memory of 1444 4812 WinRAR.exe cmd.exe PID 4812 wrote to memory of 1444 4812 WinRAR.exe cmd.exe PID 4812 wrote to memory of 1444 4812 WinRAR.exe cmd.exe PID 4812 wrote to memory of 1444 4812 WinRAR.exe cmd.exe PID 4812 wrote to memory of 1444 4812 WinRAR.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EzFN-Manager.exe"C:\Users\Admin\AppData\Local\Temp\EzFN-Manager.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Roaming\EzFN-Manager.exe"C:\Users\Admin\AppData\Roaming\EzFN-Manager.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\EzFN-Manager.exe3⤵
- Views/modifies file attributes
PID:1376
-
-
-
C:\Users\Admin\AppData\Roaming\WinRAR.exe"C:\Users\Admin\AppData\Roaming\WinRAR.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Users\Admin\Documents\WinRAR.exe"C:\Users\Admin\Documents\WinRAR.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1444
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5f42cd6ae9913f6f22ebc5eb33fa20417
SHA1bd8f8e09b670d58ce106a1c81d7f71e3a04ff307
SHA256670945d04bc299c4fd18dd958c60cb8dc30365560f910a4bef59fadf36e9ba62
SHA5129a0ef9c721cde734b754a14e20d876ee23e0283b60f3c8e7e1e0af291639a864d84d555144f618cecc9219a986bd3a554587b67c44cea3bc3b4e78d83723ee0e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
10.1MB
MD5d4c5f25a960ba6c7eb5675d7eb5df4a0
SHA1869d36d2c06b0874f55fccf792ea490a03b3e524
SHA256bb7435286298b5443ec5e7dc0c30510eb54e0fb22bd593f81974a0bf269139c6
SHA512340b2c705be89097ab88ab3514c6472d63650c02538ef1d856a76cdb9efc897c0377f8ba23bc176163556fbc31ad60717789d3d12601798c13f83ecbe8500c15
-
Filesize
297KB
MD5e54a181f1e94dfd3e427d06c32138874
SHA11a2fd8e795c9f613a25f24eb0399b629764a8f99
SHA256b9052c2cbcc38384b96e82de54a76dc0efc8b7219ebe5a35f876e1cd45c13cc5
SHA5128e51787a79e7c29204eef823ab1baab05aea5e1e792ad62171e0f86d2c6b005a2eda94833a53b2dab21c74593799826e22dae9834bc0b57a6f551ddcdb84efff