Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2024, 09:21

General

  • Target

    066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe

  • Size

    718KB

  • MD5

    32bbe58d2336cd18c22d221a3836bd50

  • SHA1

    7b559b7160fa1f0de211afd3dcb81a41a2a7fd89

  • SHA256

    066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40

  • SHA512

    66e3dd18d4beaffd40845f5b255b8c95c02bc1d72ec4a0fb831f1b6f48067599e89f8e9abdfa8579e443f6960e8e90225c22ba0995a17c56c8282204f47017a4

  • SSDEEP

    12288:9qbjoMfzukYwBZ+DPWeGHutARp7ubVoSYOKe5KkohFISCX/B:sos2+HutANuprIiroJCP

Malware Config

Extracted

Family

warzonerat

C2

wznne1.duckdns.org:63196

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
  • Hide Artifacts: Hidden Users 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe
    "C:\Users\Admin\AppData\Local\Temp\066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2156
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rRQnnfB.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4476
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rRQnnfB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA45E.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3460
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:2920
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Hide Artifacts: Hidden Users
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:3100
        • C:\Users\Admin\AppData\Local\Temp\24.exe
          "C:\Users\Admin\AppData\Local\Temp\24.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3088
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1784
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 396
            4⤵
            • Program crash
            PID:3892
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3088 -ip 3088
      1⤵
        PID:1976

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        7e24733888869b3d9790e4c38ade8f91

        SHA1

        bc7bc9ca8e12c3af1b55f35e30f2bcccdfba8876

        SHA256

        8205a90b8999fbec9f8e053c05c909a13ffeb2749c2bd2766b6602786c792aa2

        SHA512

        73316fda566c45efc704ba0402e0e49b3bc7b7ea59841b235e335bae8ffa06cbda896a14af0761ab08a590c2b6782925f75b5012ce6586ea53e16e8ab9abe8a8

      • C:\Users\Admin\AppData\Local\Temp\24.exe

        Filesize

        70KB

        MD5

        ca96229390a0e6a53e8f2125f2c01114

        SHA1

        a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

        SHA256

        0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

        SHA512

        e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjrenpex.fpc.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\freebl3.dll

        Filesize

        326KB

        MD5

        ef12ab9d0b231b8f898067b2114b1bc0

        SHA1

        6d90f27b2105945f9bb77039e8b892070a5f9442

        SHA256

        2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7

        SHA512

        2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193

      • C:\Users\Admin\AppData\Local\Temp\mozglue.dll

        Filesize

        133KB

        MD5

        75f8cc548cabf0cc800c25047e4d3124

        SHA1

        602676768f9faecd35b48c38a0632781dfbde10c

        SHA256

        fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0

        SHA512

        ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f

      • C:\Users\Admin\AppData\Local\Temp\msvcp140.dll

        Filesize

        429KB

        MD5

        109f0f02fd37c84bfc7508d4227d7ed5

        SHA1

        ef7420141bb15ac334d3964082361a460bfdb975

        SHA256

        334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

        SHA512

        46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

      • C:\Users\Admin\AppData\Local\Temp\nss3.dll

        Filesize

        1.2MB

        MD5

        d7858e8449004e21b01d468e9fd04b82

        SHA1

        9524352071ede21c167e7e4f106e9526dc23ef4e

        SHA256

        78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db

        SHA512

        1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440

      • C:\Users\Admin\AppData\Local\Temp\softokn3.dll

        Filesize

        141KB

        MD5

        471c983513694ac3002590345f2be0da

        SHA1

        6612b9af4ff6830fa9b7d4193078434ef72f775b

        SHA256

        bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f

        SHA512

        a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410

      • C:\Users\Admin\AppData\Local\Temp\tmpA45E.tmp

        Filesize

        1KB

        MD5

        562f561df09d0db3f19c5922ef309445

        SHA1

        29f756c94ab94e91c3f355fd58b42c917a5bd051

        SHA256

        420a5e33a46709e5c6638a4689ad359bc71394066c39dd9d23acf92f473804da

        SHA512

        dd69071c0af18078940a3aa7ac5aa8f26fd01115eeae799a7931b44a8261da2443b68917ed356d1af9942e9c201b339986336593f21373047aee482b0e84b19e

      • C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll

        Filesize

        81KB

        MD5

        7587bf9cb4147022cd5681b015183046

        SHA1

        f2106306a8f6f0da5afb7fc765cfa0757ad5a628

        SHA256

        c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

        SHA512

        0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

      • memory/2156-81-0x0000000007150000-0x000000000716A000-memory.dmp

        Filesize

        104KB

      • memory/2156-88-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2156-17-0x0000000004DE0000-0x0000000005408000-memory.dmp

        Filesize

        6.2MB

      • memory/2156-18-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2156-19-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2156-75-0x0000000006E10000-0x0000000006E2A000-memory.dmp

        Filesize

        104KB

      • memory/2156-15-0x00000000021D0000-0x0000000002206000-memory.dmp

        Filesize

        216KB

      • memory/2156-77-0x0000000007090000-0x0000000007126000-memory.dmp

        Filesize

        600KB

      • memory/2156-23-0x0000000004B10000-0x0000000004B32000-memory.dmp

        Filesize

        136KB

      • memory/2156-78-0x0000000007010000-0x0000000007021000-memory.dmp

        Filesize

        68KB

      • memory/2156-25-0x0000000005410000-0x0000000005476000-memory.dmp

        Filesize

        408KB

      • memory/2156-82-0x0000000007130000-0x0000000007138000-memory.dmp

        Filesize

        32KB

      • memory/2156-16-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2156-64-0x00000000755F0000-0x000000007563C000-memory.dmp

        Filesize

        304KB

      • memory/3088-99-0x00000000001E0000-0x000000000020D000-memory.dmp

        Filesize

        180KB

      • memory/3088-101-0x00000000001E0000-0x000000000020D000-memory.dmp

        Filesize

        180KB

      • memory/3100-32-0x0000000000400000-0x000000000055A000-memory.dmp

        Filesize

        1.4MB

      • memory/3100-90-0x0000000000400000-0x000000000055A000-memory.dmp

        Filesize

        1.4MB

      • memory/3100-26-0x0000000000400000-0x000000000055A000-memory.dmp

        Filesize

        1.4MB

      • memory/3100-102-0x0000000000400000-0x000000000055A000-memory.dmp

        Filesize

        1.4MB

      • memory/3100-132-0x0000000000400000-0x000000000055A000-memory.dmp

        Filesize

        1.4MB

      • memory/3224-10-0x0000000002D00000-0x0000000002D6A000-memory.dmp

        Filesize

        424KB

      • memory/3224-8-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

        Filesize

        4KB

      • memory/3224-1-0x00000000009C0000-0x0000000000A7A000-memory.dmp

        Filesize

        744KB

      • memory/3224-2-0x0000000005B00000-0x00000000060A4000-memory.dmp

        Filesize

        5.6MB

      • memory/3224-3-0x0000000005450000-0x00000000054E2000-memory.dmp

        Filesize

        584KB

      • memory/3224-4-0x0000000005510000-0x000000000551A000-memory.dmp

        Filesize

        40KB

      • memory/3224-5-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/3224-6-0x0000000005760000-0x00000000057FC000-memory.dmp

        Filesize

        624KB

      • memory/3224-7-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

        Filesize

        120KB

      • memory/3224-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

        Filesize

        4KB

      • memory/3224-48-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/3224-9-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/4476-49-0x00000000064C0000-0x00000000064DE000-memory.dmp

        Filesize

        120KB

      • memory/4476-22-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/4476-89-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB

      • memory/4476-50-0x0000000006540000-0x000000000658C000-memory.dmp

        Filesize

        304KB

      • memory/4476-80-0x0000000007A30000-0x0000000007A44000-memory.dmp

        Filesize

        80KB

      • memory/4476-39-0x0000000005EE0000-0x0000000006234000-memory.dmp

        Filesize

        3.3MB

      • memory/4476-24-0x00000000055A0000-0x0000000005606000-memory.dmp

        Filesize

        408KB

      • memory/4476-62-0x0000000006AC0000-0x0000000006ADE000-memory.dmp

        Filesize

        120KB

      • memory/4476-79-0x0000000007A20000-0x0000000007A2E000-memory.dmp

        Filesize

        56KB

      • memory/4476-52-0x00000000755F0000-0x000000007563C000-memory.dmp

        Filesize

        304KB

      • memory/4476-51-0x0000000006A80000-0x0000000006AB2000-memory.dmp

        Filesize

        200KB

      • memory/4476-76-0x0000000007870000-0x000000000787A000-memory.dmp

        Filesize

        40KB

      • memory/4476-63-0x0000000007540000-0x00000000075E3000-memory.dmp

        Filesize

        652KB

      • memory/4476-74-0x0000000007E70000-0x00000000084EA000-memory.dmp

        Filesize

        6.5MB

      • memory/4476-20-0x0000000074D40000-0x00000000754F0000-memory.dmp

        Filesize

        7.7MB