General
-
Target
136578934b4560000d7d537ff07ebd47_JaffaCakes118
-
Size
2.7MB
-
Sample
240728-ltzvtszgkq
-
MD5
136578934b4560000d7d537ff07ebd47
-
SHA1
63ffc437f1e7d70eed6cb083ba964b54923987ed
-
SHA256
671f44bbfc5482174221db55dcae82c89ff60eaaed08d0973917e0fdd47b18d4
-
SHA512
e24ebe72d71f9db8c9ab71cc4fb55af8170b3d6309970de647c189debab8203b5408977ca95a178dff3e2185a89106894c03637ce74a74a761dc8464a60b6d32
-
SSDEEP
24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81t:fF6mw4gxeOw46fUbNecCCFbNecz
Behavioral task
behavioral1
Sample
136578934b4560000d7d537ff07ebd47_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
136578934b4560000d7d537ff07ebd47_JaffaCakes118.exe
Resource
win10v2004-20240730-en
Malware Config
Targets
-
-
Target
136578934b4560000d7d537ff07ebd47_JaffaCakes118
-
Size
2.7MB
-
MD5
136578934b4560000d7d537ff07ebd47
-
SHA1
63ffc437f1e7d70eed6cb083ba964b54923987ed
-
SHA256
671f44bbfc5482174221db55dcae82c89ff60eaaed08d0973917e0fdd47b18d4
-
SHA512
e24ebe72d71f9db8c9ab71cc4fb55af8170b3d6309970de647c189debab8203b5408977ca95a178dff3e2185a89106894c03637ce74a74a761dc8464a60b6d32
-
SSDEEP
24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81t:fF6mw4gxeOw46fUbNecCCFbNecz
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4