Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 08:19
Static task
static1
Behavioral task
behavioral1
Sample
fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
fed9ab5b2162b76ab5d83a9bf07342b3
-
SHA1
0dd925c9fc2ee6b95d760d184326f32b681ffd49
-
SHA256
f507336abc0d9c301b6b7103c6be90ea15121b937e6385091e712a4f22ddc782
-
SHA512
56cff7e236ccc12df18a9b9c903e2aee4aba4838d1190551d86af68bddc38aab4de7ac8f8adca995bb7446ed49280efd9dc9270048150b59fdf78203e76478df
-
SSDEEP
24576:vJjAKND1LIQgBPiXcDvWEAU07P2vIBzjoR:vJjN9IQEiXcUo
Malware Config
Extracted
warzonerat
andronmatskiv20.sytes.net:5200
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/1592-9-0x0000000006740000-0x00000000067C2000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-10-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-11-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-13-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-15-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-17-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-19-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-21-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-23-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-25-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-27-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-29-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-31-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-33-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-35-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-37-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-39-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-41-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-43-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-45-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-47-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-49-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-51-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-53-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-55-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-57-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-59-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-61-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-63-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-65-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-67-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-69-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-71-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 behavioral2/memory/1592-73-0x0000000006740000-0x00000000067BB000-memory.dmp family_zgrat_v1 -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5068-2426-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/5068-2433-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/2592-4857-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 4156 images.exe 2592 images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exeimages.exedescription pid process target process PID 1592 set thread context of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 4156 set thread context of 2592 4156 images.exe images.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exeimages.exepid process 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe 4156 images.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exeimages.exedescription pid process Token: SeDebugPrivilege 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe Token: SeDebugPrivilege 4156 images.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exefed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exeimages.exeimages.exedescription pid process target process PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 1592 wrote to memory of 5068 1592 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe PID 5068 wrote to memory of 4156 5068 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe images.exe PID 5068 wrote to memory of 4156 5068 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe images.exe PID 5068 wrote to memory of 4156 5068 fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 4156 wrote to memory of 2592 4156 images.exe images.exe PID 2592 wrote to memory of 1456 2592 images.exe cmd.exe PID 2592 wrote to memory of 1456 2592 images.exe cmd.exe PID 2592 wrote to memory of 1456 2592 images.exe cmd.exe PID 2592 wrote to memory of 1456 2592 images.exe cmd.exe PID 2592 wrote to memory of 1456 2592 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fed9ab5b2162b76ab5d83a9bf07342b3_JaffaCakes118.exe2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\images.exeC:\Users\Admin\AppData\Local\Temp\images.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeFilesize
1.3MB
MD5fed9ab5b2162b76ab5d83a9bf07342b3
SHA10dd925c9fc2ee6b95d760d184326f32b681ffd49
SHA256f507336abc0d9c301b6b7103c6be90ea15121b937e6385091e712a4f22ddc782
SHA51256cff7e236ccc12df18a9b9c903e2aee4aba4838d1190551d86af68bddc38aab4de7ac8f8adca995bb7446ed49280efd9dc9270048150b59fdf78203e76478df
-
memory/1592-43-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-69-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-2-0x00000000057B0000-0x0000000005D54000-memory.dmpFilesize
5.6MB
-
memory/1592-3-0x0000000005200000-0x0000000005292000-memory.dmpFilesize
584KB
-
memory/1592-4-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/1592-5-0x00000000051D0000-0x00000000051DA000-memory.dmpFilesize
40KB
-
memory/1592-6-0x0000000074470000-0x0000000074C20000-memory.dmpFilesize
7.7MB
-
memory/1592-7-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/1592-8-0x0000000006460000-0x00000000064B8000-memory.dmpFilesize
352KB
-
memory/1592-9-0x0000000006740000-0x00000000067C2000-memory.dmpFilesize
520KB
-
memory/1592-10-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-11-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-13-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-15-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-17-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-19-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-21-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-23-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-25-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-27-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-29-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-31-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-33-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-35-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-37-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-39-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-41-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-0-0x00000000006D0000-0x0000000000820000-memory.dmpFilesize
1.3MB
-
memory/1592-57-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-47-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-49-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-51-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-53-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-55-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-45-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-59-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-61-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-63-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-65-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-67-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-1-0x0000000074470000-0x0000000074C20000-memory.dmpFilesize
7.7MB
-
memory/1592-71-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-73-0x0000000006740000-0x00000000067BB000-memory.dmpFilesize
492KB
-
memory/1592-403-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/1592-2421-0x0000000000F80000-0x0000000000FE6000-memory.dmpFilesize
408KB
-
memory/1592-2427-0x0000000074470000-0x0000000074C20000-memory.dmpFilesize
7.7MB
-
memory/2592-4857-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/4156-2432-0x0000000073DE0000-0x0000000074590000-memory.dmpFilesize
7.7MB
-
memory/4156-2434-0x0000000005250000-0x0000000005260000-memory.dmpFilesize
64KB
-
memory/4156-2435-0x0000000005250000-0x0000000005260000-memory.dmpFilesize
64KB
-
memory/4156-2436-0x0000000073DE0000-0x0000000074590000-memory.dmpFilesize
7.7MB
-
memory/4156-2437-0x0000000005250000-0x0000000005260000-memory.dmpFilesize
64KB
-
memory/4156-3076-0x0000000005250000-0x0000000005260000-memory.dmpFilesize
64KB
-
memory/4156-4858-0x0000000073DE0000-0x0000000074590000-memory.dmpFilesize
7.7MB
-
memory/5068-2426-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/5068-2433-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB