Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 11:36
Static task
static1
Behavioral task
behavioral1
Sample
f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
f7e8946a4954f59b836a588e29530d17
-
SHA1
388452dd34b35d51d312703106c83399fa30132c
-
SHA256
e475b9fed46639088d2fcdb7b8ab0631e4db362a3569b7d3030b8672be9df644
-
SHA512
b1a67ab8ccb44e984776632f72dcc370193178291fb457a89716b701ca9213e8d7e3a7e0a97ff63801977990e84a141d64d5717afcd4c1bebdec6cd8b1887486
-
SSDEEP
12288:7DVXSi5irusotVeJ8bdRq0vujGLjTGLSHAJ+raV35Ilb:VXB5s4cJ8vqPjmnHs+raBSb
Malware Config
Extracted
warzonerat
20.150.137.35:7400
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2552-16-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2552-17-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2552-19-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2552-20-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2552-23-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2552-25-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exedescription pid process target process PID 2960 set thread context of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2468 2552 WerFault.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exef7e8946a4954f59b836a588e29530d17_JaffaCakes118.exedescription pid process target process PID 2960 wrote to memory of 2812 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe schtasks.exe PID 2960 wrote to memory of 2812 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe schtasks.exe PID 2960 wrote to memory of 2812 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe schtasks.exe PID 2960 wrote to memory of 2812 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe schtasks.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2960 wrote to memory of 2552 2960 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe PID 2552 wrote to memory of 2468 2552 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe WerFault.exe PID 2552 wrote to memory of 2468 2552 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe WerFault.exe PID 2552 wrote to memory of 2468 2552 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe WerFault.exe PID 2552 wrote to memory of 2468 2552 f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GWmLkuqcjCByy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB960.tmp"2⤵
- Creates scheduled task(s)
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7e8946a4954f59b836a588e29530d17_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 2003⤵
- Program crash
PID:2468