Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
20/09/2024, 15:53
General
- Target ededa2f0f915bc3617f63ac1586b40bb_JaffaCakes118.exe
- Size 17KB
- Sample240920-tbmfsavarb
- SHA256 ced602ff9094977c33eabbd11a6dcc66656671d5f47596774ecc4792330d2d6a
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- RevengeRat Executable 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ededa2f0f915bc3617f63ac1586b40bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ededa2f0f915bc3617f63ac1586b40bb_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe
memory/244-6-0x00007FFF29465000-0x00007FFF29466000-memory.dmp
memory/244-2-0x000000001B670000-0x000000001BB3E000-memory.dmp
memory/244-3-0x000000001B090000-0x000000001B136000-memory.dmp
memory/244-4-0x000000001BC20000-0x000000001BC82000-memory.dmp
memory/244-5-0x00007FFF291B0000-0x00007FFF29B51000-memory.dmp
memory/244-0-0x00007FFF29465000-0x00007FFF29466000-memory.dmp
memory/244-7-0x00007FFF291B0000-0x00007FFF29B51000-memory.dmp
memory/244-1-0x00007FFF291B0000-0x00007FFF29B51000-memory.dmp
memory/244-17-0x00007FFF291B0000-0x00007FFF29B51000-memory.dmp
memory/3052-18-0x00007FFF291B0000-0x00007FFF29B51000-memory.dmp
memory/3052-19-0x00007FFF291B0000-0x00007FFF29B51000-memory.dmp
memory/3052-20-0x00007FFF291B0000-0x00007FFF29B51000-memory.dmp
memory/3052-21-0x00007FFF291B0000-0x00007FFF29B51000-memory.dmp