File name:

WARZONE RAT 2.70 POISON - cortexnet.cc.7z

Full analysis: https://app.any.run/tasks/757ee264-9a53-4897-890d-3784f9c68a07
Verdict: Malicious activity
Analysis date: February 10, 2023, 05:38:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

C4C26FFD14CAD3AB6135155CA524B1B2

SHA1:

10C4E14B1C5922D0FDB10D307019F750DDD7ADD0

SHA256:

818F218F3D84F9CF715E548A0BC1906F206B81775761A73E06FAE07AD888770B

SSDEEP:

393216:ZyrDURlHD+AGDhhjrGVtB+crh+Kzju5kgQSqMN/:Zy3U7HqAqjrGVKcA8u5kD4N/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Warzone Cracked.exe (PID: 3688)

  • SUSPICIOUS

    • The process drops Mozilla's DLL files

      • WinRAR.exe (PID: 3256)

    • Reads the Internet Settings

      • Warzone Cracked.exe (PID: 3688)

  • INFO

    • The process checks LSA protection

      • wmpnscfg.exe (PID: 1760)
      • iexplore.exe (PID: 2280)
      • iexplore.exe (PID: 1388)

    • Checks supported languages

      • wmpnscfg.exe (PID: 1760)
      • Warzone Cracked.exe (PID: 3688)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1760)
      • Warzone Cracked.exe (PID: 3688)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1760)
      • Warzone Cracked.exe (PID: 3688)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 1760)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3256)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3256)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3256)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2280)
      • iexplore.exe (PID: 1388)

    • Create files in a temporary directory

      • iexplore.exe (PID: 1388)

    • Application launched itself

      • iexplore.exe (PID: 1388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
5
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe wmpnscfg.exe no specs warzone cracked.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1388"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=Warzone Cracked.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
Warzone Cracked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\version.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\sechost.dll
1760"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2280"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1388 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3256"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\WARZONE RAT 2.70 POISON - cortexnet.cc.7z"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3688"C:\Users\admin\Desktop\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Warzone Cracked.exe" C:\Users\admin\Desktop\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Warzone Cracked.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Warzone Cracked
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\warzone rat 2.70 poison - cortexnet.cc\warzone rat 2.70 poison - cortexnet.cc\warzone cracked.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\rpcrt4.dll
Total events
28 202
Read events
27 852
Write events
340
Delete events
10

Modification events

(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3256) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\WARZONE RAT 2.70 POISON - cortexnet.cc.7z
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
40
Suspicious files
28
Text files
72
Unknown types
28

Dropped files

PID
Process
Filename
Type
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\cratclient.binexecutable
MD5:8DB7B6AA08ECBF107BDB3B8964B69734
SHA256:A60D265E1FFEE14F518BC3F1863C9F3283A0950BAA6AF3E85C558BA1D9BD4EE5
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Datas\options.vncini
MD5:6243B2004273137CB880196F4472268B
SHA256:11C79026B86D78DF113DD84848065175BC39EFADD48DF4C9768CA685E8FAFFC4
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Datas\firefox.dllsexecutable
MD5:A26861558315278D5960FE1BF58B1950
SHA256:B52720863EC78E0F7BFF98E6C809FDF50AB2D0EA361E95EB5341E870AAFB0354
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT - HIDDEN POISON 2.70.exe.configxml
MD5:D0DCE5493822E1656681460B4F78F6AA
SHA256:B0FF0741A189C9E18F151CCF4E17A7905A46D6688D6EC6327CAE4794D1CC5B18
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Datas\rdpwrap64.dllexecutable
MD5:C4063372AFE486D5E9A11C5B68E0524F
SHA256:FC1F3FC182CEF9BCEF5192E4FA4569697E27852CBFFB7A55EA6118C603DDC420
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Injector\0Harmony.xmlxml
MD5:18A7BC08B75FF941DA64A72A552FBCBC
SHA256:74539D239888DEDA7EA5D13B29B97F1551425ACCD4EE36640561E680FA51F482
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Datas\rV2.bsp1binary
MD5:7DE0184ED564E0D2076D9B3520E7CCE6
SHA256:4449673175412AACBAB5A485DEAE55DD11B2EFE67A06525DAD05C948542F7387
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Datas\rV.bsp1binary
MD5:A23A6C143732E1C83BF09FE71C78AA93
SHA256:E48D338DD5FC668888EB89E6C35E8F4B4F61B4D4BC35574C548A1BC9DBF52054
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Warzone Cracked.exe.configxml
MD5:159280C802BED8DE261D40FCF7130BC4
SHA256:65F6FF8549E1F144AB78432F69A51168A7F1B3021D23C20BF9D51393D4C92368
3256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3256.49559\WARZONE RAT 2.70 POISON - cortexnet.cc\WARZONE RAT 2.70 POISON - cortexnet.cc\Datas\ServerManager.dllexecutable
MD5:CCC5BD0D95F504FCE814E6758D4953D6
SHA256:2B658436167826D3A1E44919A1113C6F1717515BD7EF0064D7152D7C3E050FC1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
32
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2280
iexplore.exe
GET
—
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
—
—
whitelisted
2280
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
2280
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
1388
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2280
iexplore.exe
GET
200
8.59.0.190:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b637c2561c06c859
US
compressed
4.70 Kb
whitelisted
2280
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2280
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
2280
iexplore.exe
GET
200
8.253.246.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9037ec57f11e85d4
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2280
iexplore.exe
104.108.10.141:443
go.microsoft.com
AKAMAI-AS
DE
unknown
2280
iexplore.exe
8.253.246.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
—
—
2.21.20.153:443
statics-marketingsites-wcus-ms-com.akamaized.net
Akamai International B.V.
DE
suspicious
2280
iexplore.exe
2.21.20.153:443
statics-marketingsites-wcus-ms-com.akamaized.net
Akamai International B.V.
DE
suspicious
—
—
2.18.233.62:443
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2280
iexplore.exe
2.18.233.62:443
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2280
iexplore.exe
2.21.20.144:443
img-prod-cms-rt-microsoft-com.akamaized.net
Akamai International B.V.
DE
suspicious
2280
iexplore.exe
13.107.237.45:443
dotnet.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2280
iexplore.exe
52.182.141.63:443
browser.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
2280
iexplore.exe
20.9.155.148:443
westus2-0.in.applicationinsights.azure.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.108.10.141
whitelisted
ctldl.windowsupdate.com
  • 8.253.246.254
  • 8.250.163.254
  • 8.252.41.254
  • 8.59.0.126
  • 8.59.0.190
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
dotnet.microsoft.com
  • 13.107.237.45
  • 13.107.238.45
whitelisted
www.microsoft.com
  • 2.18.233.62
whitelisted
statics-marketingsites-wcus-ms-com.akamaized.net
  • 2.21.20.153
  • 2.21.20.132
whitelisted
js.monitor.azure.com
  • 13.107.237.45
  • 13.107.238.45
whitelisted
target.microsoft.com
  • 52.211.90.101
  • 52.209.9.253
  • 99.80.163.253
  • 54.76.19.168
  • 54.77.63.43
  • 63.34.224.124
  • 54.77.135.239
  • 54.246.171.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WARZONE RAT 2.70 POISON - cortexnet.cc.7z