General

  • Target

    06391e6426d272e5f9e551d8fb67030a_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240428-2jwcnabc4z

  • MD5

    06391e6426d272e5f9e551d8fb67030a

  • SHA1

    b1ffa03f8169c1fcf1052c11b8534ca6ebd57900

  • SHA256

    002fbe65888393e935785aa53603e9c78060fa737cbf13f87d9c520b71a6bc4b

  • SHA512

    82a09ab499c417fbe1b1dd019a839dc49f2e4330100be1f5caf2dd8c6fe8f01c907dab69f9168ad515715c9d8ececb736de44561ce2e4a53824759d6672e9e67

  • SSDEEP

    24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHg:3Ty7A3mw4gxeOw46fUbNecCCFbNect

Malware Config

Targets

    • Target

      06391e6426d272e5f9e551d8fb67030a_JaffaCakes118

    • Size

      2.9MB

    • MD5

      06391e6426d272e5f9e551d8fb67030a

    • SHA1

      b1ffa03f8169c1fcf1052c11b8534ca6ebd57900

    • SHA256

      002fbe65888393e935785aa53603e9c78060fa737cbf13f87d9c520b71a6bc4b

    • SHA512

      82a09ab499c417fbe1b1dd019a839dc49f2e4330100be1f5caf2dd8c6fe8f01c907dab69f9168ad515715c9d8ececb736de44561ce2e4a53824759d6672e9e67

    • SSDEEP

      24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHg:3Ty7A3mw4gxeOw46fUbNecCCFbNect

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks