Overview

overview

10

Static

static

10

08cc33b870...18.exe

windows7-x64

10

08cc33b870...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08cc33b870fc8d0ea6e59c1b2fa56d5b_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240430-cpymjaaa9s

  • MD5

    08cc33b870fc8d0ea6e59c1b2fa56d5b

  • SHA1

    11295c390fbce9aa58f6fe1150ce7649daa4590e

  • SHA256

    c4bba9e9adec81b307ec0fffced6b559a3141262acf0725855701d6390721879

  • SHA512

    d8aed53c5cfa6a7eda5e1814b1c052166481086e78f8d6f563f7c82c929f4ecc0b74d0401119e2904a820dbfc2a8033aa822319df333182a0d6d197cebc067de

  • SSDEEP

    12288:t99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgq:X1gg4CppEI6GGfWDkCQDbGV6eH81kh

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      08cc33b870fc8d0ea6e59c1b2fa56d5b_JaffaCakes118

    • Size

      1.8MB

    • MD5

      08cc33b870fc8d0ea6e59c1b2fa56d5b

    • SHA1

      11295c390fbce9aa58f6fe1150ce7649daa4590e

    • SHA256

      c4bba9e9adec81b307ec0fffced6b559a3141262acf0725855701d6390721879

    • SHA512

      d8aed53c5cfa6a7eda5e1814b1c052166481086e78f8d6f563f7c82c929f4ecc0b74d0401119e2904a820dbfc2a8033aa822319df333182a0d6d197cebc067de

    • SSDEEP

      12288:t99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgq:X1gg4CppEI6GGfWDkCQDbGV6eH81kh

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

4
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks