Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 17:56
Static task
static1
Behavioral task
behavioral1
Sample
87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
87d5c387c363d12da2820e403d03c8b3
-
SHA1
5c37c95ddf2bdbf470f98088e061047f6acc506f
-
SHA256
aaf55d748b8854f02dfeec78839b51b8b4eb404846fd8afe019ccf521bf5f746
-
SHA512
2e43f491bdf17bbcca1b183cd17aeefe01b873654ddb72dc42686cc475ed834b62664a8ff5d95584fd814420041e6a1adc858ef783efc75d9ba46f1b8d77358a
-
SSDEEP
6144:tS7ErGlSI2izLoZKhb1xhfyC55nuvYxRRAOhVxndeCiy:U7EalzzLSKhxvf/nuvYxRRjgLy
Malware Config
Extracted
warzonerat
79.134.225.105:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4592-0-0x0000000002FF0000-0x0000000003144000-memory.dmp warzonerat behavioral2/memory/4592-7-0x0000000003380000-0x0000000003F80000-memory.dmp warzonerat behavioral2/memory/4592-13-0x0000000002FF0000-0x0000000003144000-memory.dmp warzonerat behavioral2/memory/2448-64-0x00000000030B0000-0x0000000003204000-memory.dmp warzonerat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 872 powershell.exe 4396 powershell.exe -
Drops startup file 2 IoCs
Processes:
87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
images.exepid process 2448 images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
NTFS ADS 1 IoCs
Processes:
87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exedescription ioc process File created C:\ProgramData:ApplicationData 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 872 powershell.exe 872 powershell.exe 4396 powershell.exe 4396 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 872 powershell.exe Token: SeDebugPrivilege 4396 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exeimages.exedescription pid process target process PID 4592 wrote to memory of 872 4592 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe powershell.exe PID 4592 wrote to memory of 872 4592 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe powershell.exe PID 4592 wrote to memory of 872 4592 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe powershell.exe PID 4592 wrote to memory of 2448 4592 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe images.exe PID 4592 wrote to memory of 2448 4592 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe images.exe PID 4592 wrote to memory of 2448 4592 87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe images.exe PID 2448 wrote to memory of 4396 2448 images.exe powershell.exe PID 2448 wrote to memory of 4396 2448 images.exe powershell.exe PID 2448 wrote to memory of 4396 2448 images.exe powershell.exe PID 2448 wrote to memory of 992 2448 images.exe cmd.exe PID 2448 wrote to memory of 992 2448 images.exe cmd.exe PID 2448 wrote to memory of 992 2448 images.exe cmd.exe PID 2448 wrote to memory of 992 2448 images.exe cmd.exe PID 2448 wrote to memory of 992 2448 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\87d5c387c363d12da2820e403d03c8b3_JaffaCakes118.exe"1⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeFilesize
1.7MB
MD587d5c387c363d12da2820e403d03c8b3
SHA15c37c95ddf2bdbf470f98088e061047f6acc506f
SHA256aaf55d748b8854f02dfeec78839b51b8b4eb404846fd8afe019ccf521bf5f746
SHA5122e43f491bdf17bbcca1b183cd17aeefe01b873654ddb72dc42686cc475ed834b62664a8ff5d95584fd814420041e6a1adc858ef783efc75d9ba46f1b8d77358a
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5d37dca30569d8aace20026296872a4bb
SHA1a7b4f2f7a7f6d6f9b2e7ba2025e5c49ff8d3cea7
SHA25611109cfde9f1c8752039a689b2ecda97e784dcba98b65f9a6f7971aa0d342ada
SHA512cd25bd0043bc2af67dda6bb9526bd15d831238e347980a7ec66cacdda455820c7d8da66715fc3b027a1000ab2a0896e9ebfe7fc85b59ccd2ee26332f6436b479
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sa2aaht1.gfb.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/872-51-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/872-63-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/872-18-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/872-19-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/872-20-0x0000000004E80000-0x00000000054A8000-memory.dmpFilesize
6.2MB
-
memory/872-21-0x0000000004D80000-0x0000000004DA2000-memory.dmpFilesize
136KB
-
memory/872-53-0x0000000007030000-0x000000000704A000-memory.dmpFilesize
104KB
-
memory/872-22-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/872-16-0x0000000074A7E000-0x0000000074A7F000-memory.dmpFilesize
4KB
-
memory/872-33-0x0000000005740000-0x0000000005A94000-memory.dmpFilesize
3.3MB
-
memory/872-34-0x0000000005D00000-0x0000000005D1E000-memory.dmpFilesize
120KB
-
memory/872-35-0x0000000005D30000-0x0000000005D7C000-memory.dmpFilesize
304KB
-
memory/872-37-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/872-38-0x0000000070770000-0x00000000707BC000-memory.dmpFilesize
304KB
-
memory/872-36-0x00000000062C0000-0x00000000062F2000-memory.dmpFilesize
200KB
-
memory/872-48-0x0000000006310000-0x000000000632E000-memory.dmpFilesize
120KB
-
memory/872-49-0x0000000074A70000-0x0000000075220000-memory.dmpFilesize
7.7MB
-
memory/872-52-0x0000000007670000-0x0000000007CEA000-memory.dmpFilesize
6.5MB
-
memory/872-23-0x00000000056D0000-0x0000000005736000-memory.dmpFilesize
408KB
-
memory/872-17-0x00000000023D0000-0x0000000002406000-memory.dmpFilesize
216KB
-
memory/872-50-0x0000000006CF0000-0x0000000006D93000-memory.dmpFilesize
652KB
-
memory/872-54-0x00000000070A0000-0x00000000070AA000-memory.dmpFilesize
40KB
-
memory/872-55-0x00000000072B0000-0x0000000007346000-memory.dmpFilesize
600KB
-
memory/872-56-0x0000000007230000-0x0000000007241000-memory.dmpFilesize
68KB
-
memory/872-57-0x0000000007260000-0x000000000726E000-memory.dmpFilesize
56KB
-
memory/872-58-0x0000000007270000-0x0000000007284000-memory.dmpFilesize
80KB
-
memory/872-59-0x0000000007370000-0x000000000738A000-memory.dmpFilesize
104KB
-
memory/872-60-0x0000000007350000-0x0000000007358000-memory.dmpFilesize
32KB
-
memory/992-85-0x00000000011D0000-0x00000000011D1000-memory.dmpFilesize
4KB
-
memory/2448-64-0x00000000030B0000-0x0000000003204000-memory.dmpFilesize
1.3MB
-
memory/2448-71-0x0000000074790000-0x0000000074D98000-memory.dmpFilesize
6.0MB
-
memory/4396-84-0x0000000006560000-0x00000000065AC000-memory.dmpFilesize
304KB
-
memory/4396-73-0x0000000005E40000-0x0000000006194000-memory.dmpFilesize
3.3MB
-
memory/4396-87-0x0000000070360000-0x00000000703AC000-memory.dmpFilesize
304KB
-
memory/4396-97-0x0000000007780000-0x0000000007823000-memory.dmpFilesize
652KB
-
memory/4396-98-0x0000000007A50000-0x0000000007A61000-memory.dmpFilesize
68KB
-
memory/4396-99-0x0000000007A80000-0x0000000007A94000-memory.dmpFilesize
80KB
-
memory/4592-13-0x0000000002FF0000-0x0000000003144000-memory.dmpFilesize
1.3MB
-
memory/4592-7-0x0000000003380000-0x0000000003F80000-memory.dmpFilesize
12.0MB
-
memory/4592-0-0x0000000002FF0000-0x0000000003144000-memory.dmpFilesize
1.3MB