Overview

overview

10

Static

static

10

11c3ec4d59...18.exe

windows7-x64

10

11c3ec4d59...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240504-jqz1bafh2v

  • MD5

    11c3ec4d59600ba527167aa9af5fda40

  • SHA1

    b225cc2536024e154f9e4abfc1c4ed9113b2ba5b

  • SHA256

    ac5e41b4063cc321280abeb6ecbba14d548f771fd4d3bb3f8031ce756df0ae39

  • SHA512

    168debfd58fe31a89aff2c777c6b78689156c90566be36f5ed5e8aaa0b3f397e6a9480d153793ddc21422b736abe150251f907b5b1df7b3fa38a510faaf2bec4

  • SSDEEP

    24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHk:3Ty7A3mw4gxeOw46fUbNecCCFbNecZ

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118

    • Size

      2.9MB

    • MD5

      11c3ec4d59600ba527167aa9af5fda40

    • SHA1

      b225cc2536024e154f9e4abfc1c4ed9113b2ba5b

    • SHA256

      ac5e41b4063cc321280abeb6ecbba14d548f771fd4d3bb3f8031ce756df0ae39

    • SHA512

      168debfd58fe31a89aff2c777c6b78689156c90566be36f5ed5e8aaa0b3f397e6a9480d153793ddc21422b736abe150251f907b5b1df7b3fa38a510faaf2bec4

    • SSDEEP

      24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHk:3Ty7A3mw4gxeOw46fUbNecCCFbNecZ

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks