General

  • Target

    118071f1388c0d56778437e16f0302c2_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240728-kwz3yasaph

  • MD5

    118071f1388c0d56778437e16f0302c2

  • SHA1

    c37d8311660056321681192540ec34efbed0452f

  • SHA256

    8157b26cad59942dcf097300b4e30fed3339de0c4bc56c135f0fc9d62c868881

  • SHA512

    e5b9c538939db1bcea135c21a09705e49e6fb38212d585c858a27f130f33c9e7cd7ca0595af2852a21f4cd493d70ddd4392dc103f9fe5a39eed8fa1337ed83af

  • SSDEEP

    24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH6:3Ty7A3mw4gxeOw46fUbNecCCFbNecj

Malware Config

Targets

    • Target

      118071f1388c0d56778437e16f0302c2_JaffaCakes118

    • Size

      2.9MB

    • MD5

      118071f1388c0d56778437e16f0302c2

    • SHA1

      c37d8311660056321681192540ec34efbed0452f

    • SHA256

      8157b26cad59942dcf097300b4e30fed3339de0c4bc56c135f0fc9d62c868881

    • SHA512

      e5b9c538939db1bcea135c21a09705e49e6fb38212d585c858a27f130f33c9e7cd7ca0595af2852a21f4cd493d70ddd4392dc103f9fe5a39eed8fa1337ed83af

    • SSDEEP

      24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH6:3Ty7A3mw4gxeOw46fUbNecCCFbNecj

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks