General

  • Target

    06338608114168cc43195c45fb3d1bc4_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240428-2ad21saf44

  • MD5

    06338608114168cc43195c45fb3d1bc4

  • SHA1

    56c4b4263bee75a033d38782c12a7dbf7599f385

  • SHA256

    3d57b069ef8ede25c340857e62d708663b0ecb92cdc6801c2d75fb61fa8c9428

  • SHA512

    47964517235262673fa2c0ee80b525f71b79785e3f62c092704218af517199670876f296299826b982bff4989e209bdcefe69960239a62fbb128bf51265e45bd

  • SSDEEP

    24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHv:3Ty7A3mw4gxeOw46fUbNecCCFbNecM

Malware Config

Targets

    • Target

      06338608114168cc43195c45fb3d1bc4_JaffaCakes118

    • Size

      2.9MB

    • MD5

      06338608114168cc43195c45fb3d1bc4

    • SHA1

      56c4b4263bee75a033d38782c12a7dbf7599f385

    • SHA256

      3d57b069ef8ede25c340857e62d708663b0ecb92cdc6801c2d75fb61fa8c9428

    • SHA512

      47964517235262673fa2c0ee80b525f71b79785e3f62c092704218af517199670876f296299826b982bff4989e209bdcefe69960239a62fbb128bf51265e45bd

    • SSDEEP

      24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHv:3Ty7A3mw4gxeOw46fUbNecCCFbNecM

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks