Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2024, 03:22 UTC

General

  • Target

    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe

  • Size

    610KB

  • MD5

    06fe875e4701de15eb98fef1e228d32b

  • SHA1

    cca987129e4a7ce3a9853e419ccdac32130310d3

  • SHA256

    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92

  • SHA512

    276b4d6d9e4e5f7176adc19fc38c377179847d76ac53ee49dc7a318cab3a222115aa96cc90ded61f4ef6a724d0a782da5f0315867f55045ed31fbc822f436e5e

  • SSDEEP

    12288:NqrK4A9bRZmqRiYmeTLBxg6NEtuhc07M6qAvqp9YfvkR:UrKHmqnmiLBx5NEYhcmM6q8qp2q

Malware Config

Extracted

Family

warzonerat

C2

176.223.112.134:4268

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    "C:\Users\Admin\AppData\Local\Temp\cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2204
    • C:\Users\Admin\AppData\Local\Temp\cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
      "C:\Users\Admin\AppData\Local\Temp\cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:636

Network

    No results found
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    152 B
    120 B
    3
    3
  • 176.223.112.134:4268
    cc0fdb6946afd11917588ce448b752e3f49debcd09d2e4d6c6d04cc1dc774e92.exe
    104 B
    80 B
    2
    2
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/636-32-0x0000000000120000-0x0000000000121000-memory.dmp

    Filesize

    4KB

  • memory/636-30-0x0000000000120000-0x0000000000121000-memory.dmp

    Filesize

    4KB

  • memory/1580-0-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

    Filesize

    4KB

  • memory/1580-1-0x0000000000110000-0x00000000001AC000-memory.dmp

    Filesize

    624KB

  • memory/1580-2-0x0000000073D10000-0x00000000743FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1580-3-0x00000000003F0000-0x0000000000402000-memory.dmp

    Filesize

    72KB

  • memory/1580-4-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

    Filesize

    4KB

  • memory/1580-5-0x0000000073D10000-0x00000000743FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1580-6-0x00000000048A0000-0x000000000490C000-memory.dmp

    Filesize

    432KB

  • memory/1580-27-0x0000000073D10000-0x00000000743FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2752-13-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-11-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-23-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-26-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-25-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2752-19-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-17-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-15-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-9-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-7-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-35-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.