General

  • Target

    08b8b4ef89763f6ff7cf04c26f55d1a4_JaffaCakes118

  • Size

    2.7MB

  • Sample

    240728-evkc7s1cka

  • MD5

    08b8b4ef89763f6ff7cf04c26f55d1a4

  • SHA1

    98328d206ff3156ba7dfc35f1140a4dd8a5dc8b1

  • SHA256

    0f5cc4e865c6a48d6b3b10da2786b57241db71b5e4517690cb2129cf7032f841

  • SHA512

    a1d70aad6c5617077aab148ea05ce1e41c634fe123ee35308c56f8c9f5ab699058d270b5a8852a9bda07b882ffc60448cc838e74916c2edd1f79af5fbd894937

  • SSDEEP

    24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81z:fF6mw4gxeOw46fUbNecCCFbNecl

Malware Config

Targets

    • Target

      08b8b4ef89763f6ff7cf04c26f55d1a4_JaffaCakes118

    • Size

      2.7MB

    • MD5

      08b8b4ef89763f6ff7cf04c26f55d1a4

    • SHA1

      98328d206ff3156ba7dfc35f1140a4dd8a5dc8b1

    • SHA256

      0f5cc4e865c6a48d6b3b10da2786b57241db71b5e4517690cb2129cf7032f841

    • SHA512

      a1d70aad6c5617077aab148ea05ce1e41c634fe123ee35308c56f8c9f5ab699058d270b5a8852a9bda07b882ffc60448cc838e74916c2edd1f79af5fbd894937

    • SSDEEP

      24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81z:fF6mw4gxeOw46fUbNecCCFbNecl

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks