Analysis date (UTC): 30 September 2023, 18:10Analysis environment: Windows 7 Pro, build 7601, x64

payload.vbs

MD5:EBD8D4466968F9459C1E6CE8D3089371

SHA1:87CA4C6C2A9F60C3E732345F64A2193726FBBAC0

SHA256:9EDCA23169D5993D4741088D4615576995EDCB96B6EC2614ADA0FEB8792E3D75

Analysis result

Threat level:Malicious activity

Tags:

loaderwarzoneratremoteavemaria

Full analysis:Analysis payload.vbs (MD5: EBD8D4466968F9459C1E6CE8D3089371) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes powershell execution policy (Unrestricted)

wscript.exe (PID: 3296)

Drops the executable file immediately after the start

powershell.exe (PID: 3080)
Cache.exe (PID: 3380)

Application was dropped or rewritten from another process

Cache.exe (PID: 3380)
svchost.exe (PID: 1896)

Connects to the CnC server

mscorsvw.exe (PID: 2884)

WARZONE detected by memory dumps

mscorsvw.exe (PID: 2884)

Adds path to the Windows Defender exclusion list

svchost.exe (PID: 1896)

WARZONE was detected

mscorsvw.exe (PID: 2884)

AVEMARIA was detected

mscorsvw.exe (PID: 2884)

SUSPICIOUS

Powershell scripting: start process

wscript.exe (PID: 3296)

Reads the Internet Settings

wscript.exe (PID: 3296)
powershell.exe (PID: 3080)
svchost.exe (PID: 1896)

Probably download files using WebClient

wscript.exe (PID: 3296)

Starts POWERSHELL.EXE for commands execution

wscript.exe (PID: 3296)
svchost.exe (PID: 1896)

Starts CMD.EXE for commands execution

Cache.exe (PID: 3380)

Adds/modifies Windows certificates

wscript.exe (PID: 3296)

Unusual connection from system programs

powershell.exe (PID: 3080)

Creates executable files that already exist in Windows

Cache.exe (PID: 3380)

The Powershell connects to the Internet

powershell.exe (PID: 3080)

Executing commands from a ".bat" file

Cache.exe (PID: 3380)

The process creates files with name similar to system file names

Cache.exe (PID: 3380)

Connects to unusual port

mscorsvw.exe (PID: 2884)

Uses TIMEOUT.EXE to delay execution

cmd.exe (PID: 2680)

Script adds exclusion path to Windows Defender

svchost.exe (PID: 1896)

INFO

The executable file from the user directory is run by the Powershell process

Cache.exe (PID: 3380)

Reads the machine GUID from the registry

Cache.exe (PID: 3380)
svchost.exe (PID: 1896)
mscorsvw.exe (PID: 2884)

Create files in a temporary directory

Cache.exe (PID: 3380)

Checks supported languages

Cache.exe (PID: 3380)
svchost.exe (PID: 1896)
mscorsvw.exe (PID: 2884)

Reads the computer name

Cache.exe (PID: 3380)
svchost.exe (PID: 1896)
mscorsvw.exe (PID: 2884)

Creates files or folders in the user directory

Cache.exe (PID: 3380)
mscorsvw.exe (PID: 2884)

The executable file from the user directory is run by the CMD process

svchost.exe (PID: 1896)

Threats

PID	Process	Class	Message
332	svchost.exe	Potentially Bad Traffic	ET INFO DYNAMIC_DNS Query to a *.mywire .org Domain
2884	mscorsvw.exe	A Network Trojan was detected	ET MALWARE Warzone RAT Response (Inbound)