Full Report
Helping analysts develop a better understanding of the elastic search syntax.
Analysis Summary
# Tool/Technique: Ave Maria (Warzone RAT)
## Overview
Ave Maria (also known as Warzone RAT) is a high-functioning Remote Access Trojan (RAT) sold as a commodity malware-as-a-service. It is designed to provide attackers with full remote control over a compromised system, primarily focusing on credential theft, remote surveillance, and persistent access. This specific analysis focuses on a PowerShell-based delivery and persistence mechanism that utilizes the Windows Registry to hide malicious payloads.
## Technical Details
- **Type:** Malware (Remote Access Trojan)
- **Platform:** Windows
- **Capabilities:** Remote command execution, credential harvesting, file management, and stealthy persistence via registry keys.
- **First Seen:** Approximately 2018 (Analysis date: January 31, 2023)
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- **[TA0005 - Defense Evasion]**
- [T1112 - Modify Registry]
- [T1027 - Obfuscated Files or Information]
- [T1564.003 - Hijack Host Process (via environment variables)]
## Functionality
### Core Capabilities
- **Registry-Based Persistence:** The malware utilizes the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` key to launch PowerShell scripts that pull further stages from custom registry keys.
- **Environment Variable Hijacking:** Uses `GetEnvironmentVariable` to store and call malicious strings, evading simple command-line pattern matching.
- **Multi-Stage Loading:** Employs a multi-stage execution chain where the initial script decodes data stored in the `HKU\SID\Software\<HexID>` registry path.
### Advanced Features
- **AES Encryption:** Payloads are encrypted using AES (commonly in ECB or CBC modes) with a 16-byte Initialization Vector (IV).
- **Custom Obfuscation:** Uses reversed Base64 strings, array joining, and compression to hide the final payload within registry values.
- **Stealth Footprint:** Minimal disk presence by residing primarily in the registry and memory during the loading phase.
## Indicators of Compromise
- **File Names:** `powershell.exe` (Abused process)
- **Registry Keys:**
- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (Persistence)
- `HKU\<SID>\Environment` (Storage of variable triggers)
- `HKU\<SID>\Software\<[a-f0-9]{12,18}>` (Storage of encoded payloads)
- **Behavioral Indicators:**
- PowerShell commands containing `GetEnvironmentVariable`.
- Automated execution of PowerShell from environment variables (`ExecutionFromEnvironmentVariable`).
- Use of RegEx patterns like `[a-f0-9]{12,18}` in command lines or registry key names.
## Associated Threat Actors
- **Commodity Malware:** Used by various cybercriminal groups due to its availability on hacking forums.
## Detection Methods
- **Behavioral Detection:** Monitor for PowerShell processes referencing the `User` environment hive or invoking `IEX` (Invoke-Expression) on registry-stored strings.
- **Query-Based Hunting (Elastic):**
- `details.path:powershell.exe +details.command:"GetEnvironmentVariable"`
- `+process.command_line.text:"GetEnvironmentVariable" +process.command_line.text:/[a-f0-9]{12,18}/`
- **Registry Monitoring:** Alert on new, randomly named (Hex-based) subkeys under `HKCU\Software\` containing large blobs of Base64 or encrypted data.
## Mitigation Strategies
- **Hardening:** Implement AppLocker or Windows Defender Application Control (WDAC) to restrict PowerShell execution to signed scripts or Constrained Language Mode.
- **Registry Protection:** Monitor and restrict write access to `Run` and `RunOnce` keys.
- **Environment Monitoring:** Regularly audit user environment variables for suspicious entries.
## Related Tools/Techniques
- **PureRAT:** Another .NET-based RAT often used by similar threat actors.
- **ModeloRAT:** Linked to browser-based redirection attacks.
- **Living off the Land (LotL):** The technique of using legitimate tools like PowerShell for malicious purposes.