Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2024, 09:21
Static task
static1
Behavioral task
behavioral1
Sample
066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe
Resource
win10v2004-20241007-en
General
-
Target
066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe
-
Size
718KB
-
MD5
32bbe58d2336cd18c22d221a3836bd50
-
SHA1
7b559b7160fa1f0de211afd3dcb81a41a2a7fd89
-
SHA256
066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40
-
SHA512
66e3dd18d4beaffd40845f5b255b8c95c02bc1d72ec4a0fb831f1b6f48067599e89f8e9abdfa8579e443f6960e8e90225c22ba0995a17c56c8282204f47017a4
-
SSDEEP
12288:9qbjoMfzukYwBZ+DPWeGHutARp7ubVoSYOKe5KkohFISCX/B:sos2+HutANuprIiroJCP
Malware Config
Extracted
warzonerat
wznne1.duckdns.org:63196
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral2/memory/3100-26-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat behavioral2/memory/3100-32-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat behavioral2/memory/3100-90-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat behavioral2/memory/3100-102-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2156 powershell.exe 4476 powershell.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1784 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe -
Executes dropped EXE 1 IoCs
pid Process 3088 24.exe -
Loads dropped DLL 6 IoCs
pid Process 3100 vbc.exe 3100 vbc.exe 3100 vbc.exe 3100 vbc.exe 3100 vbc.exe 3100 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe -
Hide Artifacts: Hidden Users 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\.utvmm. = "0" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3224 set thread context of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 -
resource yara_rule behavioral2/files/0x000b000000023b8c-95.dat upx behavioral2/memory/3088-99-0x00000000001E0000-0x000000000020D000-memory.dmp upx behavioral2/memory/3088-101-0x00000000001E0000-0x000000000020D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3892 3088 WerFault.exe 106 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3460 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 4476 powershell.exe 2156 powershell.exe 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 2156 powershell.exe 4476 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe Token: SeDebugPrivilege 2156 powershell.exe Token: SeDebugPrivilege 4476 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3100 vbc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3224 wrote to memory of 2156 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 97 PID 3224 wrote to memory of 2156 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 97 PID 3224 wrote to memory of 2156 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 97 PID 3224 wrote to memory of 4476 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 99 PID 3224 wrote to memory of 4476 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 99 PID 3224 wrote to memory of 4476 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 99 PID 3224 wrote to memory of 3460 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 100 PID 3224 wrote to memory of 3460 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 100 PID 3224 wrote to memory of 3460 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 100 PID 3224 wrote to memory of 2920 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 103 PID 3224 wrote to memory of 2920 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 103 PID 3224 wrote to memory of 2920 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 103 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3224 wrote to memory of 3100 3224 066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe 104 PID 3100 wrote to memory of 3088 3100 vbc.exe 106 PID 3100 wrote to memory of 3088 3100 vbc.exe 106 PID 3100 wrote to memory of 3088 3100 vbc.exe 106 PID 3088 wrote to memory of 1784 3088 24.exe 107 PID 3088 wrote to memory of 1784 3088 24.exe 107 PID 3088 wrote to memory of 1784 3088 24.exe 107 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe"C:\Users\Admin\AppData\Local\Temp\066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rRQnnfB.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rRQnnfB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA45E.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3460
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2920
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Hide Artifacts: Hidden Users
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\24.exe"C:\Users\Admin\AppData\Local\Temp\24.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=33894⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 3964⤵
- Program crash
PID:3892
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3088 -ip 30881⤵PID:1976
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Users
1Impair Defenses
1Disable or Modify System Firewall
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD57e24733888869b3d9790e4c38ade8f91
SHA1bc7bc9ca8e12c3af1b55f35e30f2bcccdfba8876
SHA2568205a90b8999fbec9f8e053c05c909a13ffeb2749c2bd2766b6602786c792aa2
SHA51273316fda566c45efc704ba0402e0e49b3bc7b7ea59841b235e335bae8ffa06cbda896a14af0761ab08a590c2b6782925f75b5012ce6586ea53e16e8ab9abe8a8
-
Filesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
326KB
MD5ef12ab9d0b231b8f898067b2114b1bc0
SHA16d90f27b2105945f9bb77039e8b892070a5f9442
SHA2562b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7
SHA5122aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193
-
Filesize
133KB
MD575f8cc548cabf0cc800c25047e4d3124
SHA1602676768f9faecd35b48c38a0632781dfbde10c
SHA256fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0
SHA512ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f
-
Filesize
429KB
MD5109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
Filesize
1.2MB
MD5d7858e8449004e21b01d468e9fd04b82
SHA19524352071ede21c167e7e4f106e9526dc23ef4e
SHA25678758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db
SHA5121e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440
-
Filesize
141KB
MD5471c983513694ac3002590345f2be0da
SHA16612b9af4ff6830fa9b7d4193078434ef72f775b
SHA256bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f
SHA512a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410
-
Filesize
1KB
MD5562f561df09d0db3f19c5922ef309445
SHA129f756c94ab94e91c3f355fd58b42c917a5bd051
SHA256420a5e33a46709e5c6638a4689ad359bc71394066c39dd9d23acf92f473804da
SHA512dd69071c0af18078940a3aa7ac5aa8f26fd01115eeae799a7931b44a8261da2443b68917ed356d1af9942e9c201b339986336593f21373047aee482b0e84b19e
-
Filesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f