Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10/12/2024, 05:50
Behavioral task
behavioral1
Sample
Estado_de_cuenta.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Estado_de_cuenta.xls
Resource
win10v2004-20241007-en
General
-
Target
Estado_de_cuenta.xls
-
Size
198KB
-
MD5
98136ffd902b60b1107c02cb94fc90e2
-
SHA1
ae410c8c5d57fa37b74ff283768bd68c48dd46ae
-
SHA256
e569298451bd12f37a4c93fb610b254f6237ae89eb3f573427ace46daedd1402
-
SHA512
0ec2eb997c474c19d4ddedbae60552d2b71ce1b1c5780f35e6bafa089bf6a75e8fd1e8bf936ed65f21426274cffad36ce7ffba21ed6dda15b585b20b4e69f650
-
SSDEEP
6144:IxEtjPOtioVjDGUU1qfDlavx+W2QnAo+Ly9ckwDwPq5XlsqbwxNNip:/+VkGUqLsqIi
Malware Config
Extracted
warzonerat
dns.stipamana.com:5219
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/memory/2080-64-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2616-70-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2972-86-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
pid Process 2100 DCNXKNLRS.exe 2080 DCNXKNLRS.exe 2096 DCNXKNLRS.exe 2616 DCNXKNLRS.exe 2976 images.exe 2972 images.exe 2720 images.exe 1500 images.exe -
Loads dropped DLL 5 IoCs
pid Process 2952 EXCEL.EXE 2952 EXCEL.EXE 2952 EXCEL.EXE 2952 EXCEL.EXE 2080 DCNXKNLRS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" DCNXKNLRS.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2100 set thread context of 2080 2100 DCNXKNLRS.exe 31 PID 2100 set thread context of 2096 2100 DCNXKNLRS.exe 32 PID 2100 set thread context of 2616 2100 DCNXKNLRS.exe 33 PID 2976 set thread context of 2972 2976 images.exe 36 PID 2976 set thread context of 2720 2976 images.exe 37 PID 2976 set thread context of 1500 2976 images.exe 38 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCNXKNLRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCNXKNLRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCNXKNLRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCNXKNLRS.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2952 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2100 DCNXKNLRS.exe Token: SeDebugPrivilege 2976 images.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2952 EXCEL.EXE 2952 EXCEL.EXE 2952 EXCEL.EXE 2952 EXCEL.EXE 2952 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2100 2952 EXCEL.EXE 30 PID 2952 wrote to memory of 2100 2952 EXCEL.EXE 30 PID 2952 wrote to memory of 2100 2952 EXCEL.EXE 30 PID 2952 wrote to memory of 2100 2952 EXCEL.EXE 30 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2080 2100 DCNXKNLRS.exe 31 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2096 2100 DCNXKNLRS.exe 32 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2100 wrote to memory of 2616 2100 DCNXKNLRS.exe 33 PID 2080 wrote to memory of 2976 2080 DCNXKNLRS.exe 35 PID 2080 wrote to memory of 2976 2080 DCNXKNLRS.exe 35 PID 2080 wrote to memory of 2976 2080 DCNXKNLRS.exe 35 PID 2080 wrote to memory of 2976 2080 DCNXKNLRS.exe 35 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2972 2976 images.exe 36 PID 2976 wrote to memory of 2720 2976 images.exe 37 PID 2976 wrote to memory of 2720 2976 images.exe 37 PID 2976 wrote to memory of 2720 2976 images.exe 37 PID 2976 wrote to memory of 2720 2976 images.exe 37 PID 2976 wrote to memory of 2720 2976 images.exe 37 PID 2976 wrote to memory of 2720 2976 images.exe 37 PID 2976 wrote to memory of 2720 2976 images.exe 37 PID 2976 wrote to memory of 2720 2976 images.exe 37
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Estado_de_cuenta.xls1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972
-
-
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
PID:2720
-
-
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1500
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2096
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
319KB
MD5cad3404a925d02d351239edaa03af840
SHA182bd5b6987906034ab58e988a5f615680e6faf3b
SHA256f6ee358f1e50caebcdd8b92517d562009ac2a64e63118ddff33bd31d07d2f4c8
SHA512b15b2e7dbbb73272d17208764179b75782471c1a8ef16dad649a24c5e56173a298c58cfae909544629be782cc67067693e32a3c1cf961052799209b22175bda3