Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:43
Behavioral task
behavioral1
Sample
5a25357e1946d486c681be60578b252b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5a25357e1946d486c681be60578b252b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
5a25357e1946d486c681be60578b252b_JaffaCakes118.exe
-
Size
322KB
-
MD5
5a25357e1946d486c681be60578b252b
-
SHA1
77d1b1e1a8920183f0863e6340eda0b0bb883db5
-
SHA256
9969ddc2a9be5f780f4fcaaabb87e961f82bf99da4f031a5366e1d527ebfee29
-
SHA512
c11f6c4ba834709bc00d5e97bd12373a25023fa23aa50aab5b7f656531358660a469b00ed2a9ca005f9cc3667a5f4d496e53bee0a13815a2e95ec8201db32bdb
-
SSDEEP
6144:D4GSzYBenlp6VEJD6Lp478PyY3h2YDdsawz8:UGS7lp6VEt6JPRh1dHJ
Malware Config
Extracted
warzonerat
info1.dynamic-dns.net:5552
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/1672-1-0x0000000000F90000-0x0000000000FE6000-memory.dmp warzonerat behavioral2/memory/5088-12-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/5088-15-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/5088-16-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat C:\ProgramData\intel warzonerat behavioral2/memory/5088-25-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/2364-35-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/2364-37-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/2364-40-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat -
Drops startup file 2 IoCs
Processes:
5a25357e1946d486c681be60578b252b_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
intelintelpid process 1440 intel 2364 intel -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/1672-2-0x00000000032F0000-0x0000000003304000-memory.dmp agile_net behavioral2/memory/1440-28-0x0000000000D40000-0x0000000000D54000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5a25357e1946d486c681be60578b252b_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\intel = "C:\\ProgramData\\intel" 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5a25357e1946d486c681be60578b252b_JaffaCakes118.exeinteldescription pid process target process PID 1672 set thread context of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1440 set thread context of 2364 1440 intel intel -
NTFS ADS 1 IoCs
Processes:
5a25357e1946d486c681be60578b252b_JaffaCakes118.exedescription ioc process File created C:\ProgramData:ApplicationData 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5a25357e1946d486c681be60578b252b_JaffaCakes118.exeintelpid process 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 1440 intel 1440 intel 1440 intel -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5a25357e1946d486c681be60578b252b_JaffaCakes118.exeinteldescription pid process Token: SeDebugPrivilege 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe Token: SeDebugPrivilege 1440 intel -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5a25357e1946d486c681be60578b252b_JaffaCakes118.exe5a25357e1946d486c681be60578b252b_JaffaCakes118.exeintelinteldescription pid process target process PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 1672 wrote to memory of 5088 1672 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe PID 5088 wrote to memory of 1440 5088 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe intel PID 5088 wrote to memory of 1440 5088 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe intel PID 5088 wrote to memory of 1440 5088 5a25357e1946d486c681be60578b252b_JaffaCakes118.exe intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 1440 wrote to memory of 2364 1440 intel intel PID 2364 wrote to memory of 4772 2364 intel cmd.exe PID 2364 wrote to memory of 4772 2364 intel cmd.exe PID 2364 wrote to memory of 4772 2364 intel cmd.exe PID 2364 wrote to memory of 4772 2364 intel cmd.exe PID 2364 wrote to memory of 4772 2364 intel cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a25357e1946d486c681be60578b252b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a25357e1946d486c681be60578b252b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\5a25357e1946d486c681be60578b252b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a25357e1946d486c681be60578b252b_JaffaCakes118.exe"2⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\ProgramData\intel"C:\ProgramData\intel"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\ProgramData\intel"C:\ProgramData\intel"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵PID:4772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\intelFilesize
322KB
MD55a25357e1946d486c681be60578b252b
SHA177d1b1e1a8920183f0863e6340eda0b0bb883db5
SHA2569969ddc2a9be5f780f4fcaaabb87e961f82bf99da4f031a5366e1d527ebfee29
SHA512c11f6c4ba834709bc00d5e97bd12373a25023fa23aa50aab5b7f656531358660a469b00ed2a9ca005f9cc3667a5f4d496e53bee0a13815a2e95ec8201db32bdb
-
memory/1440-36-0x0000000074360000-0x0000000074B10000-memory.dmpFilesize
7.7MB
-
memory/1440-30-0x0000000074360000-0x0000000074B10000-memory.dmpFilesize
7.7MB
-
memory/1440-29-0x0000000074360000-0x0000000074B10000-memory.dmpFilesize
7.7MB
-
memory/1440-28-0x0000000000D40000-0x0000000000D54000-memory.dmpFilesize
80KB
-
memory/1440-27-0x000000007436E000-0x000000007436F000-memory.dmpFilesize
4KB
-
memory/1672-7-0x0000000005B40000-0x0000000005B84000-memory.dmpFilesize
272KB
-
memory/1672-4-0x0000000003300000-0x0000000003308000-memory.dmpFilesize
32KB
-
memory/1672-9-0x0000000074A5E000-0x0000000074A5F000-memory.dmpFilesize
4KB
-
memory/1672-10-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1672-11-0x0000000006A90000-0x0000000006AB2000-memory.dmpFilesize
136KB
-
memory/1672-1-0x0000000000F90000-0x0000000000FE6000-memory.dmpFilesize
344KB
-
memory/1672-8-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1672-2-0x00000000032F0000-0x0000000003304000-memory.dmpFilesize
80KB
-
memory/1672-17-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/1672-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmpFilesize
4KB
-
memory/1672-3-0x0000000005EA0000-0x0000000006444000-memory.dmpFilesize
5.6MB
-
memory/1672-6-0x0000000005A70000-0x0000000005A78000-memory.dmpFilesize
32KB
-
memory/1672-5-0x0000000005990000-0x0000000005A22000-memory.dmpFilesize
584KB
-
memory/2364-35-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/2364-37-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/2364-40-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/4772-38-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/5088-25-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/5088-16-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/5088-15-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/5088-12-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB