Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277.exe
-
Size
703KB
-
Sample
250310-pcr1fatygy
-
MD5
5d5439b5ce694c7329f002033dc479b5
-
SHA1
fa00d36077c1a8442c5f44cbdf7545a041e85ed3
-
SHA256
4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277
-
SHA512
f66685591e4504f802f4895bbfbeee8a524a78a09d7813e4e9d5e34cddaa2ea49635db1c09f658f5279e7999fe7a59db4514187e2f33f4f3d5c02f9cf6b8fb0e
-
SSDEEP
12288:4Io7W7X/WI7oDLmMjWQumYISeIQAAApLlX2/MT77oyhDdsCGW:foSbWqqmFQumNLInpSAhDd
Static task
static1
Behavioral task
behavioral1
Sample
4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277.exe
Resource
win10v2004-20250217-en
Malware Config
Extracted
warzonerat
193.23.160.31:6008
Targets
-
-
Target
4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277.exe
-
Size
703KB
-
MD5
5d5439b5ce694c7329f002033dc479b5
-
SHA1
fa00d36077c1a8442c5f44cbdf7545a041e85ed3
-
SHA256
4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277
-
SHA512
f66685591e4504f802f4895bbfbeee8a524a78a09d7813e4e9d5e34cddaa2ea49635db1c09f658f5279e7999fe7a59db4514187e2f33f4f3d5c02f9cf6b8fb0e
-
SSDEEP
12288:4Io7W7X/WI7oDLmMjWQumYISeIQAAApLlX2/MT77oyhDdsCGW:foSbWqqmFQumNLInpSAhDd
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1