General
-
Target
0629bbcac6b7bbd7ae2689291fc2de1d_JaffaCakes118
-
Size
1.8MB
-
Sample
240728-c5xeeaxalc
-
MD5
0629bbcac6b7bbd7ae2689291fc2de1d
-
SHA1
af610e49b18a3812e991cba0d473969a26af42c8
-
SHA256
a805fcd4f0af0023afcbba9e4ada8b2f59ba0b85e6785ccd3a0b2ec28e56e89e
-
SHA512
067451208e7c4689ef070c817570e9bbfdd615d383a3f7b2f36d9e2aaee9c0b7fa50166207bb5295cf1726be05afe49621bd7bec35b1f02e8f58a1100489edb1
-
SSDEEP
12288:t99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgg:X1gg4CppEI6GGfWDkCQDbGV6eH81kr
Behavioral task
behavioral1
Sample
0629bbcac6b7bbd7ae2689291fc2de1d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0629bbcac6b7bbd7ae2689291fc2de1d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
0629bbcac6b7bbd7ae2689291fc2de1d_JaffaCakes118
-
Size
1.8MB
-
MD5
0629bbcac6b7bbd7ae2689291fc2de1d
-
SHA1
af610e49b18a3812e991cba0d473969a26af42c8
-
SHA256
a805fcd4f0af0023afcbba9e4ada8b2f59ba0b85e6785ccd3a0b2ec28e56e89e
-
SHA512
067451208e7c4689ef070c817570e9bbfdd615d383a3f7b2f36d9e2aaee9c0b7fa50166207bb5295cf1726be05afe49621bd7bec35b1f02e8f58a1100489edb1
-
SSDEEP
12288:t99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgg:X1gg4CppEI6GGfWDkCQDbGV6eH81kr
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4