Overview

overview

10

Static

static

10

10e2dd4f42...18.exe

windows7-x64

10

10e2dd4f42...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240503-tc816saf2w

  • MD5

    10e2dd4f425ef30d4f3fe5ec98a03d5d

  • SHA1

    2e2b1af404c9d6bde505b373c50fc19872c91498

  • SHA256

    794b9a2b8b506360ba92a9a69c40b303b37e43e88ae408db8a1b86c741014968

  • SHA512

    65483b97cf8e46f33700da4e70434f7be3270ab8eacafe1a36a460b2886e3ffa44a4ba4e29f05eeaeee665f0e60990065854fc622866ebe0df422c60c9238047

  • SSDEEP

    24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHt:3Ty7A3mw4gxeOw46fUbNecCCFbNecU

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118

    • Size

      2.9MB

    • MD5

      10e2dd4f425ef30d4f3fe5ec98a03d5d

    • SHA1

      2e2b1af404c9d6bde505b373c50fc19872c91498

    • SHA256

      794b9a2b8b506360ba92a9a69c40b303b37e43e88ae408db8a1b86c741014968

    • SHA512

      65483b97cf8e46f33700da4e70434f7be3270ab8eacafe1a36a460b2886e3ffa44a4ba4e29f05eeaeee665f0e60990065854fc622866ebe0df422c60c9238047

    • SSDEEP

      24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHt:3Ty7A3mw4gxeOw46fUbNecCCFbNecU

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks