Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
06/04/2024, 04:57
General
- Target dbcfc21ffafc545f171df65dd419682a_JaffaCakes118.exe
- Size 940KB
- Sample240406-flayvabh34
- SHA256 7d3323da32cb30fed5acbc1b1e0f053ee43d111a5c354c3bae95d580e54a7e79
Malware Config
Extracted
-
warzonerat
-
pastorcc.duckdns.org:2223
Signatures
- Detects BazaLoader malware 4 IoCs
BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbcfc21ffafc545f171df65dd419682a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dbcfc21ffafc545f171df65dd419682a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ADSFDGFHGJHKJJH" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ADSFEDGRFHGJH.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ADSFDGFHGJHKJJH" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ADSFEDGRFHGJH.exe"3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Roaming\ADSFEDGRFHGJH.exe"C:\Users\Admin\AppData\Roaming\ADSFEDGRFHGJH.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AddInProcess32.exe
__PSScriptPolicyTest_hsnbwfev.1uj.ps1
ADSFEDGRFHGJH.exe
memory/232-24-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/232-55-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/232-63-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/232-28-0x0000000009140000-0x0000000009146000-memory.dmp
memory/232-39-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/232-27-0x00000000064A0000-0x00000000064B4000-memory.dmp
memory/232-26-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/232-25-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/1152-6-0x00000000066F0000-0x0000000006756000-memory.dmp
memory/1152-4-0x0000000005750000-0x0000000005760000-memory.dmp
memory/1152-9-0x0000000005750000-0x0000000005760000-memory.dmp
memory/1152-8-0x0000000006900000-0x0000000006992000-memory.dmp
memory/1152-7-0x00000000066B0000-0x00000000066D2000-memory.dmp
memory/1152-5-0x0000000006650000-0x0000000006678000-memory.dmp
memory/1152-1-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/1152-23-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/1152-0-0x0000000000AA0000-0x0000000000B90000-memory.dmp
memory/1152-2-0x0000000005390000-0x00000000056E4000-memory.dmp
memory/1152-3-0x0000000005800000-0x000000000589C000-memory.dmp
memory/1336-82-0x0000000000400000-0x000000000055E000-memory.dmp
memory/1336-34-0x0000000000400000-0x000000000055E000-memory.dmp
memory/1336-33-0x0000000000400000-0x000000000055E000-memory.dmp
memory/1336-30-0x0000000000400000-0x000000000055E000-memory.dmp
memory/3200-40-0x00000000053E0000-0x0000000005A08000-memory.dmp
memory/3200-42-0x0000000005A40000-0x0000000005A62000-memory.dmp
memory/3200-43-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/3200-41-0x0000000004DA0000-0x0000000004DB0000-memory.dmp
memory/3200-53-0x00000000062E0000-0x00000000062FE000-memory.dmp
memory/3200-54-0x0000000006370000-0x00000000063BC000-memory.dmp
memory/3200-38-0x0000000004DA0000-0x0000000004DB0000-memory.dmp
memory/3200-37-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/3200-68-0x0000000006890000-0x00000000068AE000-memory.dmp
memory/3200-69-0x00000000074F0000-0x0000000007593000-memory.dmp
memory/3200-57-0x000000006D390000-0x000000006D3DC000-memory.dmp
memory/3200-56-0x00000000068B0000-0x00000000068E2000-memory.dmp
memory/3200-70-0x0000000007C50000-0x00000000082CA000-memory.dmp
memory/3200-71-0x0000000007610000-0x000000000762A000-memory.dmp
memory/3200-72-0x0000000007680000-0x000000000768A000-memory.dmp
memory/3200-73-0x0000000007890000-0x0000000007926000-memory.dmp
memory/3200-74-0x0000000007810000-0x0000000007821000-memory.dmp
memory/3200-75-0x0000000007840000-0x000000000784E000-memory.dmp
memory/3200-76-0x0000000007850000-0x0000000007864000-memory.dmp
memory/3200-77-0x0000000007950000-0x000000000796A000-memory.dmp
memory/3200-78-0x0000000007930000-0x0000000007938000-memory.dmp
memory/3200-81-0x0000000074AC0000-0x0000000075270000-memory.dmp
memory/3200-36-0x0000000004D00000-0x0000000004D36000-memory.dmp