General

  • Target

    06edb93e0c90e94eea0008483076e824_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240429-f77vpscb3s

  • MD5

    06edb93e0c90e94eea0008483076e824

  • SHA1

    313d320920be5bfb24f53746559d6f18f0460f4b

  • SHA256

    43dbdda9d4bcc3a1113777c1eb3e77475b195a22ffc5a93f067e4a61509be999

  • SHA512

    8a4ecdfe0a4b83c9646e248542f91205d8f5f623990c5a56444d96fe7cc8c39ab5a9041f06b553e2776f4be074ff1e5949f52cb2e6c6880680272f5a738b475d

  • SSDEEP

    24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHp:3Ty7A3mw4gxeOw46fUbNecCCFbNeca

Malware Config

Targets

    • Target

      06edb93e0c90e94eea0008483076e824_JaffaCakes118

    • Size

      2.9MB

    • MD5

      06edb93e0c90e94eea0008483076e824

    • SHA1

      313d320920be5bfb24f53746559d6f18f0460f4b

    • SHA256

      43dbdda9d4bcc3a1113777c1eb3e77475b195a22ffc5a93f067e4a61509be999

    • SHA512

      8a4ecdfe0a4b83c9646e248542f91205d8f5f623990c5a56444d96fe7cc8c39ab5a9041f06b553e2776f4be074ff1e5949f52cb2e6c6880680272f5a738b475d

    • SSDEEP

      24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHp:3Ty7A3mw4gxeOw46fUbNecCCFbNeca

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks