Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 14:08
General
-
Target
EzFN-Manager.exe
-
Size
10.5MB
-
MD5
e528490c86b7bbd42cee5eb2ec1dcaa0
-
SHA1
758ea1f40317648d9c0eb6f3540158bdbc1860a4
-
SHA256
a5b3e8a7c2cace998612199ffdfda738d3107ebafc810219c1a648467cefcb05
-
SHA512
fce546b12944c6b08c016532a6f49fdb5d45412025de2600a59079f29323bb2732d756f802999a3fb46e84e52dd93c1c2acdde59a9feaf102546455976f41863
-
SSDEEP
196608:HxmZUWfcvgWCpS1rpAcfBSOfMJiNbguUhFk7668rH55oHG:HwG0WCyrpAcfzf9bgT4xc5+G
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EzFN-Manager.exe"C:\Users\Admin\AppData\Local\Temp\EzFN-Manager.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EzFN-Manager.exe"C:\Users\Admin\AppData\Roaming\EzFN-Manager.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\EzFN-Manager.exe3⤵
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Roaming\WinRAR.exe"C:\Users\Admin\AppData\Roaming\WinRAR.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\WinRAR.exe"C:\Users\Admin\Documents\WinRAR.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\SubmitSplit.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5a335abe5cdd19993da2941c6c2925f2d
SHA15de0d42cfc7062edeea3179bda6f6730ee592075
SHA256e14755063842c0a31f68160b16350a82a6fe853c1eca98e076a9a35d30f09e7e
SHA51224a4d4c3b596b4121a33a5d8762e2f23167bf5c7a4e5884e6cd8a9e226c15f132912b429819acbe364f27b956ad246cf273fc7cf3bdd5e7085856c5555e8819a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
10.1MB
MD5d4c5f25a960ba6c7eb5675d7eb5df4a0
SHA1869d36d2c06b0874f55fccf792ea490a03b3e524
SHA256bb7435286298b5443ec5e7dc0c30510eb54e0fb22bd593f81974a0bf269139c6
SHA512340b2c705be89097ab88ab3514c6472d63650c02538ef1d856a76cdb9efc897c0377f8ba23bc176163556fbc31ad60717789d3d12601798c13f83ecbe8500c15
-
Filesize
247B
MD54c99baf57b4640c49ac0e27c45337d42
SHA1d0b90dd7cc491670442b9574df441ba0d5c94c72
SHA256ac37f27171253b2fbfc13999ba804f14a143169cf80e5cd8a03e0b694c16d2ab
SHA51285c1b9a3dae48524d690f7bed941b2037d13aa8abd6dc8029d45698f70936256ad4614dbfe860beb988a328bf2defd898659be6da282749d847bf642b44ade0c
-
Filesize
608KB
MD5f411b35276cdd5d619fcc13c00bb7e61
SHA1e4c73de1b09201dbca428a7895d581cfb282de6e
SHA256ace5cc859cd67a4bee9a194fca83096b31db4d52d40e7945717c37df9f896fb4
SHA512ad724509a05474dcdfeae2d52521432a6106fd257b7457d2c1e017f8e77b81f65023710dbfe1dd46978ab1a72e7b15723e6a91464e24bf48ce266b389112caa7
-
Filesize
297KB
MD5e54a181f1e94dfd3e427d06c32138874
SHA11a2fd8e795c9f613a25f24eb0399b629764a8f99
SHA256b9052c2cbcc38384b96e82de54a76dc0efc8b7219ebe5a35f876e1cd45c13cc5
SHA5128e51787a79e7c29204eef823ab1baab05aea5e1e792ad62171e0f86d2c6b005a2eda94833a53b2dab21c74593799826e22dae9834bc0b57a6f551ddcdb84efff
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
10.5MB
-
Filesize
200KB
-
Filesize
136KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
6.5MB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
652KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB