File name: | WARZONE RAT 1.89.zip |
Full analysis: | https://app.any.run/tasks/dba2b730-2658-4382-8a50-6e11ea9a8945 |
Verdict: | Malicious activity |
Analysis date: | April 23, 2019, 12:01:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | DACE5E510A5868CF8A19E53F8AE06C2F |
SHA1: | D6806589691F51AC14FDE665F9EBBDA56AC6945F |
SHA256: | 6998346F222A1B82CCB88645F8B8D159B7EB476C076EF7A18C1606F2D2BBCE08 |
SSDEEP: | 393216:IFKfp6uNojFncU4SlLbO2Ts2VMMcGZVR4Oph8skg0Eejch5P7OK:IGVCjFnccm05VMmZF8szhejy5yK |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | WARZONE RAT 1.89/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2019:04:12 17:10:04 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2960 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\WARZONE RAT 1.89.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 Modules
| |||||||||||||||
3896 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3232 | "C:\Users\admin\Desktop\WARZONE RAT 1.89\WARZONE RAT 1.89.exe" | C:\Users\admin\Desktop\WARZONE RAT 1.89\WARZONE RAT 1.89.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: WARZONE RAT 1.89 Exit code: 2148734720 Version: 1.8.9.0 Modules
| |||||||||||||||
2716 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | WARZONE RAT 1.89.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3012 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2716 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3604 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2716 CREDAT:71938 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2168 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
2516 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6b600f18,0x6b600f28,0x6b600f34 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
3316 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2192 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
2404 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=960,14914790123563892350,985098277853863837,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=4868864138435964157 --mojo-platform-channel-handle=980 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 73.0.3683.75 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\Datas\rV.bsp1 | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\Datas\rvncviewer.exe | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\Datas\ServerManager.dll | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\Datas\SocksManager.exe | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\Datas\sqlite3.dll | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\Datas\tvnviewer.exe | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\Datas\vncviewer.exe | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\License.dll | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\PETools.dll | — | |
MD5:— | SHA256:— | |||
2960 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2960.41475\WARZONE RAT 1.89\WARZONE RAT 1.89.exe | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3012 | iexplore.exe | GET | 302 | 172.227.168.22:80 | http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=WARZONE%20RAT%201.89.exe&platform=0000&osver=5&isServer.net%204.7.2shimver=4.0.30319.0 | US | — | — | whitelisted |
3012 | iexplore.exe | GET | 302 | 172.227.168.22:80 | http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=WARZONE%20RAT%201.89.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0 | US | — | — | whitelisted |
3012 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/search?q=.net+4.7.2&src=IE-SearchBox&FORM=IE8SRC | US | html | 26.5 Kb | whitelisted |
2716 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2716 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3012 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/sa/simg/SharedSpriteDesktopRewards_022118.png | US | image | 5.73 Kb | whitelisted |
3012 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/fd/ls/l?IG=9DA537F983A945D69096CB0ED996A82B&CID=257B9FAFE4CF6A96041992E8E5E76B34&Type=Event.CPT&DATA={"pp":{"S":"L","FC":171,"BC":250,"SE":-1,"TC":-1,"H":359,"BP":484,"CT":500,"IL":2},"ad":[-1,-1,772,444,1089,498,0]}&P=SERP&DA=Ch1b | US | image | 5.73 Kb | whitelisted |
3012 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rb/5q/cj,nj/c44ec255/9a358300.js?bu=Eo0frB_THtge6QTmHugeuB_qHvEe-R6kH6Iflh-HHpEdlB2KHg | US | text | 4.95 Kb | whitelisted |
3012 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/fd/ls/GLinkPing.aspx?IG=9DA537F983A945D69096CB0ED996A82B&CID=257B9FAFE4CF6A96041992E8E5E76B34&&ID=SERP,5096.1&url=https%3A%2F%2Fdotnet.microsoft.com%2Fdownload%2Fdotnet-framework%2Fnet472 | US | compressed | 816 b | whitelisted |
3012 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/fd/ls/l?IG=9DA537F983A945D69096CB0ED996A82B&CID=257B9FAFE4CF6A96041992E8E5E76B34&Type=Event.ClientInst&DATA=[{"T":"CI.GetError","FID":"CI","Name":"JSGetError","Text":"%27SVGElement%27%20is%20undefined","Meta":"http%3A//www.bing.com/search%3Fq%3D.net+4.7.2%26src%3DIE-SearchBox%26FORM%3DIE8SRC","Line":9264735,"Char":%20undefined}] | US | compressed | 773 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3012 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2716 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3012 | iexplore.exe | 23.96.207.177:443 | dotnetdownloadservice.azurewebsites.net | Microsoft Corporation | US | whitelisted |
3012 | iexplore.exe | 52.160.40.218:443 | dotnet.microsoft.com | Microsoft Corporation | US | unknown |
3012 | iexplore.exe | 172.227.168.22:443 | go.microsoft.com | Akamai International B.V. | US | whitelisted |
3012 | iexplore.exe | 172.227.168.22:80 | go.microsoft.com | Akamai International B.V. | US | whitelisted |
3012 | iexplore.exe | 52.231.32.10:80 | 8d0456cd7957950f53f0d788bb372d80.clo.footprintdns.com | Microsoft Corporation | KR | whitelisted |
3012 | iexplore.exe | 65.55.163.78:443 | login.live.com | Microsoft Corporation | US | whitelisted |
3012 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
3012 | iexplore.exe | 13.107.18.254:80 | cf466516677836e7252b42ecb9e07da2.clo.footprintdns.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
dotnetdownloadservice.azurewebsites.net |
| unknown |
login.live.com |
| whitelisted |
dotnet.microsoft.com |
| whitelisted |
8d0456cd7957950f53f0d788bb372d80.clo.footprintdns.com |
| unknown |
cf466516677836e7252b42ecb9e07da2.clo.footprintdns.com |
| suspicious |
e7c69a62579c0b9d10dea8bf60aecd31.clo.footprintdns.com |
| unknown |
90cb006e71b54590ff836db4163c4bd6.clo.footprintdns.com |
| unknown |
92b640edc8a340e6b53fd85771018e10.clo.footprintdns.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2168 | chrome.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |