Analysis
-
max time kernel
127s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 05:02
Static task
static1
Behavioral task
behavioral1
Sample
f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe
-
Size
970KB
-
MD5
f990e61f27aa6b6f21e22ec66da256bc
-
SHA1
b1b3ab210652a8268424489d272091e811833f08
-
SHA256
e90bb8f634ea320dd9e39c3f7c007402c0a696ef31cce92a259c7fca6e479514
-
SHA512
f161ef18e7e8d748168638f2c92eb05759bc002185578cfd0f672c16dba267fc2329930b479e204c974d736e64f65bf072e0ee80e2b0d131892079263b561a22
-
SSDEEP
12288:eDK0n3qGaNHEyC9/oR9gy5FHK7zRsugClbeiIOUiw3fRAruzUDABXamsyPL1xmIw:eDKcPp9AR95yVsuMizcvaAsixxSiUtj
Malware Config
Extracted
warzonerat
45.137.22.62:4231
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4636-18-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4636-21-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4636-22-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4636-24-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exedescription pid process target process PID 4352 set thread context of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exepid process 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exedescription pid process target process PID 4352 wrote to memory of 1516 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe schtasks.exe PID 4352 wrote to memory of 1516 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe schtasks.exe PID 4352 wrote to memory of 1516 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe schtasks.exe PID 4352 wrote to memory of 1876 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 1876 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 1876 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe PID 4352 wrote to memory of 4636 4352 f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VIOgFBAzGifYU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE1C5.tmp"2⤵
- Creates scheduled task(s)
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe"2⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f990e61f27aa6b6f21e22ec66da256bc_JaffaCakes118.exe"2⤵PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51fddaa00cb6b14a7688cfb234e66129c
SHA1a6d93a36ea3a46e8ac2db4c1550bc03220e01f0f
SHA256d8400311e65fa9badba826e945a8609b84e9135a5e333f59efda415b03be6aa8
SHA5120a23aa5304e91bcc5ed42eab53b15f1d85abe21d02f854a9192e8d6aed72f48eb216261317b9dd1cebd27c3655bf37f6094fa3ffe535546639ca865dd6e9d91f