General

  • Target

    02f3e69a7de134b196907cbe9d55f489_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240427-lk6l1sgd7w

  • MD5

    02f3e69a7de134b196907cbe9d55f489

  • SHA1

    34d706dd108e8f0e285ffcab7052240fe9ac924d

  • SHA256

    db75e4293b4f352d0bc274bcb656f2b039edd0bd3e3c6c6290e3f544677b3065

  • SHA512

    9b3dde9dc82865281158943cef51d57439b321a6085f9279636d95bce31202ee81a72d6f0dc8591a1cebd41ff5ed6da6f544b4b9613b34d2e0851687074dbe58

  • SSDEEP

    12288:p99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDg9:r1gg4CppEI6GGfWDkCQDbGV6eH81ku

Malware Config

Targets

    • Target

      02f3e69a7de134b196907cbe9d55f489_JaffaCakes118

    • Size

      1.8MB

    • MD5

      02f3e69a7de134b196907cbe9d55f489

    • SHA1

      34d706dd108e8f0e285ffcab7052240fe9ac924d

    • SHA256

      db75e4293b4f352d0bc274bcb656f2b039edd0bd3e3c6c6290e3f544677b3065

    • SHA512

      9b3dde9dc82865281158943cef51d57439b321a6085f9279636d95bce31202ee81a72d6f0dc8591a1cebd41ff5ed6da6f544b4b9613b34d2e0851687074dbe58

    • SSDEEP

      12288:p99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDg9:r1gg4CppEI6GGfWDkCQDbGV6eH81ku

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks