Overview

overview

10

Static

static

10

094d0c370e...18.exe

windows7-x64

10

094d0c370e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    094d0c370efd8c9a5ea8d47dce2f1ce2_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240430-hz3l5afe8s

  • MD5

    094d0c370efd8c9a5ea8d47dce2f1ce2

  • SHA1

    2b540b88f7938eaf16ab3223c6548cf66f5f264c

  • SHA256

    e36c2d0c6009077d95423bbe64c5b09316d70f8591f2fe05bfaa3c3beba77099

  • SHA512

    6f2db19acdda4b71cff6953fa6b42461aa8d01ee6808b8f086c3508889dc7bdd6b9eeac8f1af3ff88b189c959f6252c0e18a2778e3ceb523996cd2906bcf93fb

  • SSDEEP

    24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH9:ATU7AAmw4gxeOw46fUbNecCCFbNecC

Score
10/10
warzoneratevasioninfostealerpersistenceratupx

Malware Config

Targets

    • Target

      094d0c370efd8c9a5ea8d47dce2f1ce2_JaffaCakes118

    • Size

      2.9MB

    • MD5

      094d0c370efd8c9a5ea8d47dce2f1ce2

    • SHA1

      2b540b88f7938eaf16ab3223c6548cf66f5f264c

    • SHA256

      e36c2d0c6009077d95423bbe64c5b09316d70f8591f2fe05bfaa3c3beba77099

    • SHA512

      6f2db19acdda4b71cff6953fa6b42461aa8d01ee6808b8f086c3508889dc7bdd6b9eeac8f1af3ff88b189c959f6252c0e18a2778e3ceb523996cd2906bcf93fb

    • SSDEEP

      24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH9:ATU7AAmw4gxeOw46fUbNecCCFbNecC

    Score
    10/10
    warzoneratevasioninfostealerpersistenceratupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks