Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-04-2024 12:08

General

  • Target

    ff3d380d75da0970ca814403921a512d_JaffaCakes118.exe

  • Size

    336KB

  • MD5

    ff3d380d75da0970ca814403921a512d

  • SHA1

    bd06d7efc8946846addb9593893ac91a668d1e75

  • SHA256

    1c2437ae6ffc0eee1e868edc26540d7b1fc8992209ec776644fc8c83c83b0032

  • SHA512

    0e9fcbd1f3753a11a5745e467d630fd36077879df982d8cf98e06e08718e4d369c452c7ad8819dbdf93ad6685e2fa99ec9b059cff0c5feaf69236ad80b280f3c

  • SSDEEP

    6144:iFOwiyeVH0dxiroXWm/XFWdLUiIr5QhXY+lG9ijjz8QTOV0y4AS7E:yiyexQtVwYXyYOGe/811zn

Malware Config

Extracted

Family

warzonerat

C2

hjjhjkk.ydns.eu:7009

Signatures

  • Detect ZGRat V1 34 IoCs
  • Detects BazaLoader malware 4 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Warzone RAT payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff3d380d75da0970ca814403921a512d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff3d380d75da0970ca814403921a512d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Users\Admin\AppData\Local\Temp\ff3d380d75da0970ca814403921a512d_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ff3d380d75da0970ca814403921a512d_JaffaCakes118.exe
      2⤵
        PID:2700
      • C:\Users\Admin\AppData\Local\Temp\ff3d380d75da0970ca814403921a512d_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\ff3d380d75da0970ca814403921a512d_JaffaCakes118.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:680
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
            4⤵
              PID:2580
          • C:\ProgramData\images.exe
            "C:\ProgramData\images.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4392
            • C:\Users\Admin\AppData\Local\Temp\images.exe
              C:\Users\Admin\AppData\Local\Temp\images.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:640
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe"
                5⤵
                  PID:232

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\images.exe

          Filesize

          336KB

          MD5

          ff3d380d75da0970ca814403921a512d

          SHA1

          bd06d7efc8946846addb9593893ac91a668d1e75

          SHA256

          1c2437ae6ffc0eee1e868edc26540d7b1fc8992209ec776644fc8c83c83b0032

          SHA512

          0e9fcbd1f3753a11a5745e467d630fd36077879df982d8cf98e06e08718e4d369c452c7ad8819dbdf93ad6685e2fa99ec9b059cff0c5feaf69236ad80b280f3c

        • memory/640-4423-0x0000000000400000-0x000000000055E000-memory.dmp

          Filesize

          1.4MB

        • memory/640-4420-0x0000000000400000-0x000000000055E000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-2209-0x0000000000400000-0x000000000055E000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-2213-0x0000000000400000-0x000000000055E000-memory.dmp

          Filesize

          1.4MB

        • memory/4392-2215-0x0000000073EB0000-0x0000000074660000-memory.dmp

          Filesize

          7.7MB

        • memory/4392-2216-0x0000000005660000-0x0000000005670000-memory.dmp

          Filesize

          64KB

        • memory/4392-4419-0x0000000073EB0000-0x0000000074660000-memory.dmp

          Filesize

          7.7MB

        • memory/4392-2966-0x0000000005660000-0x0000000005670000-memory.dmp

          Filesize

          64KB

        • memory/4392-2217-0x0000000073EB0000-0x0000000074660000-memory.dmp

          Filesize

          7.7MB

        • memory/4800-35-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-45-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-7-0x0000000006290000-0x00000000062E6000-memory.dmp

          Filesize

          344KB

        • memory/4800-8-0x0000000006360000-0x00000000063D6000-memory.dmp

          Filesize

          472KB

        • memory/4800-9-0x00000000064D0000-0x000000000653E000-memory.dmp

          Filesize

          440KB

        • memory/4800-10-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-11-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-15-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-13-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-17-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-19-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-21-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-23-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-25-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-27-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-29-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-31-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-33-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-5-0x0000000004D10000-0x0000000004D1A000-memory.dmp

          Filesize

          40KB

        • memory/4800-37-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-39-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-41-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-43-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-6-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/4800-47-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-49-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-51-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-53-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-55-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-57-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-59-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-61-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-63-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-65-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-67-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-69-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-4-0x0000000004CF0000-0x0000000004D00000-memory.dmp

          Filesize

          64KB

        • memory/4800-3-0x0000000004B60000-0x0000000004BF2000-memory.dmp

          Filesize

          584KB

        • memory/4800-2-0x0000000005070000-0x0000000005614000-memory.dmp

          Filesize

          5.6MB

        • memory/4800-1-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/4800-0-0x0000000000150000-0x00000000001AA000-memory.dmp

          Filesize

          360KB

        • memory/4800-71-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-73-0x00000000064D0000-0x0000000006539000-memory.dmp

          Filesize

          420KB

        • memory/4800-308-0x0000000004CF0000-0x0000000004D00000-memory.dmp

          Filesize

          64KB

        • memory/4800-2203-0x0000000006330000-0x000000000634E000-memory.dmp

          Filesize

          120KB

        • memory/4800-2207-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB