Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 21:08
General
-
Target
ee6d202c314430288e1babc3c9256f40_JaffaCakes118.exe
-
Size
361KB
-
MD5
ee6d202c314430288e1babc3c9256f40
-
SHA1
e1db7db841535428e0bd482b6fcd4e35a5ec7c33
-
SHA256
4393b05a23f05af255589f1c32935811d2e6a8f112e54c956b8c52051e0a4669
-
SHA512
ef6ef49b3e5a57a699b2802d2a53ff48db3230e68944bb1b69f8f77180c283055f2efaee59553c7e19371e0bb904084e178f26cea8312ca55e2280057552ecf2
-
SSDEEP
6144:Ul6YqK05YIe1QlzZPGrllLF/NABJj7PF4eSvJHnmrKqslCjru8dkcVLf1DQ7LaaN:IlqKjSzZPGRlpU1F3SvJulXvVdDIpJXD
Malware Config
Extracted
webmonitor
qqsola.wm01.to:443
-
config_key
jJYLbTB9TsvWtCPWrodDFU1k5EBbvtuI
-
private_key
neS5F12vo
-
url_path
/recv5.php
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 9 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee6d202c314430288e1babc3c9256f40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee6d202c314430288e1babc3c9256f40_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
968KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
968KB
-
Filesize
16.0MB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB