Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 08:04
Static task
static1
Behavioral task
behavioral1
Sample
1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe
-
Size
284KB
-
MD5
1ff9b1f3cce75540c7a5f664822a7fa5
-
SHA1
17e3060ca811708a53ba2bcb1e64b1c1ad1b9377
-
SHA256
79cb1ad7f322fcbe1d6d40a6e6604e9546d12a342824edb5290ef83d043d1065
-
SHA512
4175bca8d1d79c54bfd1df38b3a16d8d2cf39a3ef2434871600e0bd122206f1cb5d941f353accea7ac67b9172a9d721db149e0e3289925c39d721e92a750ff43
-
SSDEEP
6144:3lAcPLOpOym0A6RzqMmpAmYD0pJH4eC3ALv1Dc+:V5PCsLAzqimY4pJYe2A5Q+
Malware Config
Extracted
warzonerat
phllka.com:5400
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4904-5-0x0000000000400000-0x000000000044B000-memory.dmp warzonerat behavioral2/memory/4904-2-0x0000000000400000-0x000000000044B000-memory.dmp warzonerat behavioral2/memory/4904-10-0x0000000000400000-0x000000000044B000-memory.dmp warzonerat behavioral2/memory/4244-14-0x0000000000400000-0x000000000044B000-memory.dmp warzonerat behavioral2/memory/4244-15-0x0000000000400000-0x000000000044B000-memory.dmp warzonerat behavioral2/memory/4244-18-0x0000000000400000-0x000000000044B000-memory.dmp warzonerat -
Executes dropped EXE 1 IoCs
Processes:
clock.exepid process 4244 clock.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\clock = "C:\\ProgramData\\clock.exe" 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.execlock.exepid process 4904 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe 4904 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe 4244 clock.exe 4244 clock.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.execlock.exepid process 4904 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe 4904 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe 4244 clock.exe 4244 clock.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.execlock.exepid process 4904 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe 4244 clock.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exedescription pid process target process PID 4904 wrote to memory of 4244 4904 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe clock.exe PID 4904 wrote to memory of 4244 4904 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe clock.exe PID 4904 wrote to memory of 4244 4904 1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe clock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\ProgramData\clock.exe"C:\ProgramData\clock.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD51ff9b1f3cce75540c7a5f664822a7fa5
SHA117e3060ca811708a53ba2bcb1e64b1c1ad1b9377
SHA25679cb1ad7f322fcbe1d6d40a6e6604e9546d12a342824edb5290ef83d043d1065
SHA5124175bca8d1d79c54bfd1df38b3a16d8d2cf39a3ef2434871600e0bd122206f1cb5d941f353accea7ac67b9172a9d721db149e0e3289925c39d721e92a750ff43