General

  • Target

    0645215c6a1e89b30237226aa58f9466_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240428-23cdwsbg4s

  • MD5

    0645215c6a1e89b30237226aa58f9466

  • SHA1

    5a2dbc75d00f4f7923fa3adb9bfe6d3af244f4a4

  • SHA256

    6f64ce0d6e5250530c67147bfabde946f6f9dd5f1ef970583ad0993a6b9bbd5c

  • SHA512

    2f7a23f5076d016370c5c1407523303685186133e15b72f9aa34e0324afcffef94ee28a9f3e02626325e59237a0c1815bcc68ae0f6df1c6c18926772f3636bfd

  • SSDEEP

    24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH6:3Ty7A3mw4gxeOw46fUbNecCCFbNecB

Malware Config

Targets

    • Target

      0645215c6a1e89b30237226aa58f9466_JaffaCakes118

    • Size

      2.9MB

    • MD5

      0645215c6a1e89b30237226aa58f9466

    • SHA1

      5a2dbc75d00f4f7923fa3adb9bfe6d3af244f4a4

    • SHA256

      6f64ce0d6e5250530c67147bfabde946f6f9dd5f1ef970583ad0993a6b9bbd5c

    • SHA512

      2f7a23f5076d016370c5c1407523303685186133e15b72f9aa34e0324afcffef94ee28a9f3e02626325e59237a0c1815bcc68ae0f6df1c6c18926772f3636bfd

    • SSDEEP

      24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH6:3Ty7A3mw4gxeOw46fUbNecCCFbNecB

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks