Overview

overview

10

Static

static

10

122fbe3a03...18.exe

windows7-x64

10

122fbe3a03...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240504-lv1thsdb46

  • MD5

    122fbe3a03ec201bdcf3b9e8c7620ad9

  • SHA1

    939ed9f1afa640a55ae901234621d64bb1b14125

  • SHA256

    b503371fbde7b8b385cfad82bc1c2c4b89754daf986982febe95dc4c1c5a1498

  • SHA512

    97fee72ab47bdbbaf99ad1b59151c2bd6e31eebe660bab09f7a6f686198de191ab845d3e81994af9426ca87f889e61614c49b43066d72fd723bd1da007613b10

  • SSDEEP

    24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHd:ATU7AAmw4gxeOw46fUbNecCCFbNecA

Score
10/10
warzoneratevasioninfostealerpersistenceratupx

Malware Config

Targets

    • Target

      122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118

    • Size

      2.9MB

    • MD5

      122fbe3a03ec201bdcf3b9e8c7620ad9

    • SHA1

      939ed9f1afa640a55ae901234621d64bb1b14125

    • SHA256

      b503371fbde7b8b385cfad82bc1c2c4b89754daf986982febe95dc4c1c5a1498

    • SHA512

      97fee72ab47bdbbaf99ad1b59151c2bd6e31eebe660bab09f7a6f686198de191ab845d3e81994af9426ca87f889e61614c49b43066d72fd723bd1da007613b10

    • SSDEEP

      24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHd:ATU7AAmw4gxeOw46fUbNecCCFbNecA

    Score
    10/10
    warzoneratevasioninfostealerpersistenceratupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks