Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 11:13
Static task
static1
Behavioral task
behavioral1
Sample
1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe
-
Size
377KB
-
MD5
1768a22ad081724971c9a709488d41d3
-
SHA1
a180bfc90402a3cd3656c2a5a2ba876987e055b4
-
SHA256
93983480e656ab227ef8c96b10fa2360ca628bc34689d05d6483a87a8b3af014
-
SHA512
ee173b87e207c655990b8a26791a6150b13177786ba1bc6d04fc467bf0fdf219f996ab5d2e9599f9de323744ebc981a79f38f162051ffed5ae141a763a0564d0
-
SSDEEP
6144:vAiuocJAT7f5t3FiyvaKS9zAUNwu+Tb6Z45AqP87KW40:Yiu5Juv1iyvaKHUf+fcgzyKf0
Malware Config
Extracted
warzonerat
stoic.gleeze.com:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/848-7-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/848-10-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/848-12-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/848-26-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/464-39-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 4932 images.exe 464 images.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1768a22ad081724971c9a709488d41d3_JaffaCakes118.exeimages.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Macromedia\\StikyNot.exe" 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Macromedia\\StikyNot.exe" images.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
1768a22ad081724971c9a709488d41d3_JaffaCakes118.exeimages.exedescription pid process target process PID 4572 set thread context of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 set thread context of 4376 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe svchost.exe PID 4932 set thread context of 464 4932 images.exe images.exe PID 4932 set thread context of 4084 4932 images.exe svchost.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe1768a22ad081724971c9a709488d41d3_JaffaCakes118.exeimages.exedescription pid process target process PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 848 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe PID 4572 wrote to memory of 4376 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe svchost.exe PID 4572 wrote to memory of 4376 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe svchost.exe PID 4572 wrote to memory of 4376 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe svchost.exe PID 4572 wrote to memory of 4376 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe svchost.exe PID 4572 wrote to memory of 4376 4572 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe svchost.exe PID 848 wrote to memory of 4932 848 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe images.exe PID 848 wrote to memory of 4932 848 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe images.exe PID 848 wrote to memory of 4932 848 1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 464 4932 images.exe images.exe PID 4932 wrote to memory of 4084 4932 images.exe svchost.exe PID 4932 wrote to memory of 4084 4932 images.exe svchost.exe PID 4932 wrote to memory of 4084 4932 images.exe svchost.exe PID 4932 wrote to memory of 4084 4932 images.exe svchost.exe PID 4932 wrote to memory of 4084 4932 images.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1768a22ad081724971c9a709488d41d3_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
PID:464 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"4⤵PID:4084
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵PID:4376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD51768a22ad081724971c9a709488d41d3
SHA1a180bfc90402a3cd3656c2a5a2ba876987e055b4
SHA25693983480e656ab227ef8c96b10fa2360ca628bc34689d05d6483a87a8b3af014
SHA512ee173b87e207c655990b8a26791a6150b13177786ba1bc6d04fc467bf0fdf219f996ab5d2e9599f9de323744ebc981a79f38f162051ffed5ae141a763a0564d0