General

  • Target

    06c4d4a91da45d77b98e87f19a7ffd3d_JaffaCakes118

  • Size

    2.7MB

  • Sample

    240429-ejenkshg3v

  • MD5

    06c4d4a91da45d77b98e87f19a7ffd3d

  • SHA1

    f127d209d067505716c20bdb14b1b245e113e196

  • SHA256

    72f9abde303690e3c62ee66c82ffa5d0fea52babaab059ae63664987a98c477d

  • SHA512

    7440028b363cf66ee8b8aa0595d18239b5417a440c0b587c6a7c8ca21d0bcd035b6dacc5deefb5a820211b5e2fc51359f4318104dc40ae565e994103e7ae2f2c

  • SSDEEP

    24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81w:fF6mw4gxeOw46fUbNecCCFbNec+

Malware Config

Targets

    • Target

      06c4d4a91da45d77b98e87f19a7ffd3d_JaffaCakes118

    • Size

      2.7MB

    • MD5

      06c4d4a91da45d77b98e87f19a7ffd3d

    • SHA1

      f127d209d067505716c20bdb14b1b245e113e196

    • SHA256

      72f9abde303690e3c62ee66c82ffa5d0fea52babaab059ae63664987a98c477d

    • SHA512

      7440028b363cf66ee8b8aa0595d18239b5417a440c0b587c6a7c8ca21d0bcd035b6dacc5deefb5a820211b5e2fc51359f4318104dc40ae565e994103e7ae2f2c

    • SSDEEP

      24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81w:fF6mw4gxeOw46fUbNecCCFbNec+

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks