Analysis

  • max time kernel
    154s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 11:43

General

  • Target

    fa39a305180ccfd7fe227d94f463f900_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    fa39a305180ccfd7fe227d94f463f900

  • SHA1

    a97c990b46b5ff05b46dc6778a6f79b92c2618d8

  • SHA256

    3e6e256f7b7d79667eceba8888a26457124a33e09adc8d4bb8bc883335acd4b0

  • SHA512

    4fee67879b3fcb4ec4f16c52dd7d5b87618e4f8af61bc2517062e8a31124ad18b2ac6f7a095bfeafb0d09ad22d4294d856d453dd22b585c32bbb27a5605cbbf0

  • SSDEEP

    6144:yFiODSVo8MrfuwkDvRBFyV9tDH6VdIa3aLHbufFrXj+SRrhW+QE5jUQyygegclqR:yswSGF2w3EzxBlK

Malware Config

Extracted

Family

warzonerat

C2

akwz.mypets.ws:2849

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 4 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa39a305180ccfd7fe227d94f463f900_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa39a305180ccfd7fe227d94f463f900_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1648
    • C:\ProgramData\images.exe
      "C:\ProgramData\images.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Add-MpPreference -ExclusionPath C:\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2032
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
          PID:4836

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\images.exe

      Filesize

      1.3MB

      MD5

      fa39a305180ccfd7fe227d94f463f900

      SHA1

      a97c990b46b5ff05b46dc6778a6f79b92c2618d8

      SHA256

      3e6e256f7b7d79667eceba8888a26457124a33e09adc8d4bb8bc883335acd4b0

      SHA512

      4fee67879b3fcb4ec4f16c52dd7d5b87618e4f8af61bc2517062e8a31124ad18b2ac6f7a095bfeafb0d09ad22d4294d856d453dd22b585c32bbb27a5605cbbf0

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      3d086a433708053f9bf9523e1d87a4e8

      SHA1

      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

      SHA256

      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

      SHA512

      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      766d00b8a163c8f38f6ca0ed73a476b4

      SHA1

      cc766bf66b13cab5797f67670d9e0030037dba9c

      SHA256

      7de5e67f4073016ac12b0cb503f88e5e66cc67ae4cc330bf9cd13efa278abad9

      SHA512

      33e3cbae1bec767cbe7cd3a0360f07041b37145eb141dd47b876728be55ad77b779915a16dde25997008d6d879b5b13f58f6b47d38a55ec7e4ea5db185b63c76

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2tjkw53q.e0x.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1648-53-0x0000000007660000-0x0000000007703000-memory.dmp

      Filesize

      652KB

    • memory/1648-37-0x0000000006470000-0x000000000648E000-memory.dmp

      Filesize

      120KB

    • memory/1648-55-0x0000000007790000-0x00000000077AA000-memory.dmp

      Filesize

      104KB

    • memory/1648-56-0x0000000007800000-0x000000000780A000-memory.dmp

      Filesize

      40KB

    • memory/1648-20-0x00000000743B0000-0x0000000074B60000-memory.dmp

      Filesize

      7.7MB

    • memory/1648-22-0x0000000002B40000-0x0000000002B76000-memory.dmp

      Filesize

      216KB

    • memory/1648-21-0x0000000005140000-0x0000000005150000-memory.dmp

      Filesize

      64KB

    • memory/1648-23-0x0000000005780000-0x0000000005DA8000-memory.dmp

      Filesize

      6.2MB

    • memory/1648-24-0x00000000056A0000-0x00000000056C2000-memory.dmp

      Filesize

      136KB

    • memory/1648-27-0x0000000005DB0000-0x0000000005E16000-memory.dmp

      Filesize

      408KB

    • memory/1648-65-0x00000000743B0000-0x0000000074B60000-memory.dmp

      Filesize

      7.7MB

    • memory/1648-31-0x0000000005E20000-0x0000000005E86000-memory.dmp

      Filesize

      408KB

    • memory/1648-36-0x0000000006060000-0x00000000063B4000-memory.dmp

      Filesize

      3.3MB

    • memory/1648-59-0x00000000079C0000-0x00000000079CE000-memory.dmp

      Filesize

      56KB

    • memory/1648-38-0x00000000064C0000-0x000000000650C000-memory.dmp

      Filesize

      304KB

    • memory/1648-39-0x0000000005140000-0x0000000005150000-memory.dmp

      Filesize

      64KB

    • memory/1648-40-0x000000007FDF0000-0x000000007FE00000-memory.dmp

      Filesize

      64KB

    • memory/1648-41-0x0000000006A50000-0x0000000006A82000-memory.dmp

      Filesize

      200KB

    • memory/1648-42-0x0000000075380000-0x00000000753CC000-memory.dmp

      Filesize

      304KB

    • memory/1648-52-0x0000000006A30000-0x0000000006A4E000-memory.dmp

      Filesize

      120KB

    • memory/1648-62-0x0000000007AB0000-0x0000000007AB8000-memory.dmp

      Filesize

      32KB

    • memory/1648-54-0x0000000007DD0000-0x000000000844A000-memory.dmp

      Filesize

      6.5MB

    • memory/1648-61-0x0000000007AD0000-0x0000000007AEA000-memory.dmp

      Filesize

      104KB

    • memory/1648-57-0x0000000007A10000-0x0000000007AA6000-memory.dmp

      Filesize

      600KB

    • memory/1648-60-0x00000000079D0000-0x00000000079E4000-memory.dmp

      Filesize

      80KB

    • memory/1648-58-0x0000000007990000-0x00000000079A1000-memory.dmp

      Filesize

      68KB

    • memory/2032-92-0x000000007FCB0000-0x000000007FCC0000-memory.dmp

      Filesize

      64KB

    • memory/2032-88-0x0000000005B40000-0x0000000005B8C000-memory.dmp

      Filesize

      304KB

    • memory/2032-105-0x0000000007010000-0x0000000007024000-memory.dmp

      Filesize

      80KB

    • memory/2032-107-0x00000000743B0000-0x0000000074B60000-memory.dmp

      Filesize

      7.7MB

    • memory/2032-104-0x0000000006FD0000-0x0000000006FE1000-memory.dmp

      Filesize

      68KB

    • memory/2032-103-0x0000000006D30000-0x0000000006DD3000-memory.dmp

      Filesize

      652KB

    • memory/2032-93-0x0000000070C10000-0x0000000070C5C000-memory.dmp

      Filesize

      304KB

    • memory/2032-74-0x00000000743B0000-0x0000000074B60000-memory.dmp

      Filesize

      7.7MB

    • memory/2032-75-0x00000000022D0000-0x00000000022E0000-memory.dmp

      Filesize

      64KB

    • memory/2032-76-0x00000000022D0000-0x00000000022E0000-memory.dmp

      Filesize

      64KB

    • memory/2032-77-0x0000000005410000-0x0000000005764000-memory.dmp

      Filesize

      3.3MB

    • memory/2032-91-0x00000000022D0000-0x00000000022E0000-memory.dmp

      Filesize

      64KB

    • memory/4080-1-0x0000000003210000-0x0000000003364000-memory.dmp

      Filesize

      1.3MB

    • memory/4080-2-0x0000000002710000-0x0000000003210000-memory.dmp

      Filesize

      11.0MB

    • memory/4080-16-0x0000000003210000-0x0000000003364000-memory.dmp

      Filesize

      1.3MB

    • memory/4080-13-0x0000000076010000-0x00000000761B0000-memory.dmp

      Filesize

      1.6MB

    • memory/4080-17-0x0000000076010000-0x00000000761B0000-memory.dmp

      Filesize

      1.6MB

    • memory/4080-0-0x0000000076010000-0x00000000761B0000-memory.dmp

      Filesize

      1.6MB

    • memory/4776-19-0x0000000076010000-0x00000000761B0000-memory.dmp

      Filesize

      1.6MB

    • memory/4776-66-0x0000000003490000-0x00000000035E4000-memory.dmp

      Filesize

      1.3MB

    • memory/4836-89-0x0000000000890000-0x0000000000891000-memory.dmp

      Filesize

      4KB