Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

WarzoneRAT.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    72s
  • max time network
    74s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    22/01/2025, 13:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WarzoneRAT.exe

  • Size

    321KB

  • MD5

    600e0dbaefc03f7bf50abb0def3fb465

  • SHA1

    1b5f0ac48e06edc4ed8243be61d71077f770f2b4

  • SHA256

    61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

  • SHA512

    151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

  • SSDEEP

    6144:62GhN2db088fTdUuNU0we+HPps1zcJLVPzGKfwQ7PHC3NJTyhtPB1m:62iNG088fTWsU0wJBsGJPf4Q7PHC3NJ8

Score
10/10
warzoneratdiscoveryinfostealerratrezer0

Malware Config

Extracted

Family

warzonerat

C2

168.61.222.215:5400

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzonerat family
    warzonerat
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Warzone RAT payload 4 IoCs
    rat
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7705.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:32
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4668
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /7
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2916
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4524
    • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
      "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
      1⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6915.tmp"
        2⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4484
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
          PID:4232
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4528
      • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
        "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
        1⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:460
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6F20.tmp"
          2⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1716
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
            PID:3608
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            2⤵
              PID:4648
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4352
          • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
            "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
            1⤵
            • Checks computer location settings
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5032
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp74AE.tmp"
              2⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1068
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4024
          • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
            "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
            1⤵
            • Checks computer location settings
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3308
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C01.tmp"
              2⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4448
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4952
          • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
            "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
            1⤵
            • Checks computer location settings
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2392
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp83A2.tmp"
              2⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4956
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:3172
          • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
            "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3432
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8A88.tmp"
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5656
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              2⤵
                PID:6772
            • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
              "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
              1⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4724
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8920.tmp"
                2⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5328
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                2⤵
                  PID:6252
              • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                1⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1356
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp896F.tmp"
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:5200
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  2⤵
                    PID:6340
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    2⤵
                      PID:6360
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      2⤵
                        PID:6380
                    • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                      "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                      1⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2664
                      • C:\Windows\SysWOW64\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8A59.tmp"
                        2⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:5376
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        2⤵
                          PID:6280
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          2⤵
                            PID:6316
                        • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                          "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3800
                          • C:\Windows\SysWOW64\schtasks.exe
                            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8A2A.tmp"
                            2⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:5440
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            2⤵
                              PID:6388
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                              2⤵
                                PID:6412
                            • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                              "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                              1⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4932
                              • C:\Windows\SysWOW64\schtasks.exe
                                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp88D2.tmp"
                                2⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:5240
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                2⤵
                                  PID:6172
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                  2⤵
                                    PID:6204
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                    2⤵
                                      PID:6224
                                  • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                    "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                    1⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3428
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8A5A.tmp"
                                      2⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:5496
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                      2⤵
                                        PID:6476
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                        2⤵
                                          PID:6520
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                          2⤵
                                            PID:6548
                                        • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                          "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3168
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp898E.tmp"
                                            2⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5288
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                            2⤵
                                              PID:6424
                                          • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                            "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                            1⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4692
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8AD6.tmp"
                                              2⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5664
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                              2⤵
                                                PID:6788
                                            • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                              "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                              1⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2200
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8BB1.tmp"
                                                2⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:5844
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                2⤵
                                                  PID:7012
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                  2⤵
                                                    PID:7048
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                    2⤵
                                                      PID:7076
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                      2⤵
                                                        PID:7120
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                        2⤵
                                                          PID:7144
                                                      • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                        1⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1592
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8C2E.tmp"
                                                          2⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5888
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                          2⤵
                                                            PID:7020
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                            2⤵
                                                              PID:7056
                                                          • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                            1⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:384
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8C8B.tmp"
                                                              2⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5824
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                              2⤵
                                                                PID:6684
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                2⤵
                                                                  PID:6708
                                                              • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                1⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5008
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8DA5.tmp"
                                                                  2⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:6060
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                  2⤵
                                                                    PID:6716
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                    2⤵
                                                                      PID:6752
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                      2⤵
                                                                        PID:6820
                                                                    • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                      1⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:864
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp"
                                                                        2⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:1904
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                        2⤵
                                                                          PID:6764
                                                                      • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                        1⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1308
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8E70.tmp"
                                                                          2⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:6068
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                          2⤵
                                                                            PID:7036
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                            2⤵
                                                                              PID:7064
                                                                          • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                            1⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5032
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8C4D.tmp"
                                                                              2⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:5852
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                              2⤵
                                                                                PID:6744
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                2⤵
                                                                                  PID:6800
                                                                              • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                                1⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5028
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8E60.tmp"
                                                                                  2⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:3584
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                  2⤵
                                                                                    PID:6944
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                    2⤵
                                                                                      PID:6960
                                                                                  • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                                    1⤵
                                                                                      PID:1120
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8FD7.tmp"
                                                                                        2⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:2256
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                        2⤵
                                                                                          PID:6952
                                                                                      • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                                        1⤵
                                                                                          PID:5164
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9025.tmp"
                                                                                            2⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:5356
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                            2⤵
                                                                                              PID:6780
                                                                                          • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                                            1⤵
                                                                                              PID:5172
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8FE7.tmp"
                                                                                                2⤵
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:3232
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                2⤵
                                                                                                  PID:7152
                                                                                              • C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
                                                                                                1⤵
                                                                                                  PID:5980
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92A6.tmp"
                                                                                                    2⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:6488
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                    2⤵
                                                                                                      PID:5604
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                      2⤵
                                                                                                        PID:5352

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WarzoneRAT.exe.log
                                                                                                      Filesize

                                                                                                      507B

                                                                                                      MD5

                                                                                                      99bc7c92ff1f6642977ff3c7465fab28

                                                                                                      SHA1

                                                                                                      1eff41803e0e41dc0875a487c0518b1b57d06361

                                                                                                      SHA256

                                                                                                      786039babd4fa235b09901db1874338548d823ddd8fb4e801f84b880eb2bb49a

                                                                                                      SHA512

                                                                                                      8edb36c9a1045f34a72b4b376b63324d3df7d61008a63bd84b8e764bedff9b460fb0b260ca9ffbe5a79a3a8468e52f419adef3ea197fa89f8268d0d93457dda4

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp7705.tmp
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      664589af886b2a4a0633a9cf96d7cd2b

                                                                                                      SHA1

                                                                                                      992b8f456a07a15b03cbe3bd20a5371aa3053892

                                                                                                      SHA256

                                                                                                      8ad5cbea85b1c004d2040a67e9372eb195c7adc078b8e774b60df4cb3e923c8b

                                                                                                      SHA512

                                                                                                      d3a03639273068d1548ef463777fbf9ed5fa647dd20bfc92fe8adf97ef317fc8015290f8c8ea734c9d48c7bb91b2d914a3fa8fa9980e9c5281b3a021e3db5245

                                                                                                      Download Submit

                                                                                                    • memory/2348-15-0x00000000745F0000-0x0000000074DA1000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.7MB

                                                                                                      Download

                                                                                                    • memory/2348-3-0x0000000005C90000-0x0000000005D22000-memory.dmp

                                                                                                      Filesize

                                                                                                      584KB

                                                                                                      Download

                                                                                                    • memory/2348-4-0x00000000745F0000-0x0000000074DA1000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.7MB

                                                                                                      Download

                                                                                                    • memory/2348-5-0x0000000005C70000-0x0000000005C78000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      Download

                                                                                                    • memory/2348-6-0x00000000067C0000-0x000000000685C000-memory.dmp

                                                                                                      Filesize

                                                                                                      624KB

                                                                                                      Download

                                                                                                    • memory/2348-7-0x0000000006720000-0x0000000006748000-memory.dmp

                                                                                                      Filesize

                                                                                                      160KB

                                                                                                      Download

                                                                                                    • memory/2348-2-0x0000000006040000-0x00000000065E6000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.6MB

                                                                                                      Download

                                                                                                    • memory/2348-1-0x0000000000EB0000-0x0000000000F06000-memory.dmp

                                                                                                      Filesize

                                                                                                      344KB

                                                                                                      Download

                                                                                                    • memory/2348-0-0x00000000745FE000-0x00000000745FF000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-29-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-26-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-19-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-24-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-17-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-18-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-25-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-23-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-28-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2916-27-0x000002A9C4770000-0x000002A9C4771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/4668-14-0x0000000000400000-0x0000000000553000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                      Download

                                                                                                    • memory/4668-16-0x0000000000400000-0x0000000000553000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                      Download

                                                                                                    • memory/4668-10-0x0000000000400000-0x0000000000553000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                      Download

                                                                                                    • memory/4668-13-0x0000000000400000-0x0000000000553000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                      Download