General

  • Target

    059fc8426222577f327679c84f86145b_JaffaCakes118

  • Size

    2.7MB

  • Sample

    240728-cj9slssbqr

  • MD5

    059fc8426222577f327679c84f86145b

  • SHA1

    d4cd2255b577615f57fd48edcbb187998e0ed629

  • SHA256

    24db2fa3051ae26aab85a8d759b9128db19f8a209e7308df30a21c0975322ef2

  • SHA512

    ad4afc7bf3354cb125f97ee629fa4102eecd9028c5a7eb6d8d4ac3b3b0a50e057e49fafc4a8692f4199e15325ad57cd82c0323032ccbb6d71ef2ea511d7d2b69

  • SSDEEP

    24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH813:fF6mw4gxeOw46fUbNecCCFbNech

Malware Config

Targets

    • Target

      059fc8426222577f327679c84f86145b_JaffaCakes118

    • Size

      2.7MB

    • MD5

      059fc8426222577f327679c84f86145b

    • SHA1

      d4cd2255b577615f57fd48edcbb187998e0ed629

    • SHA256

      24db2fa3051ae26aab85a8d759b9128db19f8a209e7308df30a21c0975322ef2

    • SHA512

      ad4afc7bf3354cb125f97ee629fa4102eecd9028c5a7eb6d8d4ac3b3b0a50e057e49fafc4a8692f4199e15325ad57cd82c0323032ccbb6d71ef2ea511d7d2b69

    • SSDEEP

      24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH813:fF6mw4gxeOw46fUbNecCCFbNech

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks