Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2024, 21:31

General

  • Target

    5ec4184027a7bd0a061cdbca475d3217_JaffaCakes118.exe

  • Size

    600KB

  • MD5

    5ec4184027a7bd0a061cdbca475d3217

  • SHA1

    b6e2880543b7a2f89ee4a207c4855f07c170ce42

  • SHA256

    2dfa3ed19b53b34a0cb48c8e54481cd21bc297ba77294f855c385216db75563b

  • SHA512

    8826008218e001bd40bc5bba1f30ad48b301b7172a727e88e0ab3b9fc48abcce691cea94b5bef29779edc8273bff96481002acc9d0149b54bb042e442e9b6ea7

  • SSDEEP

    12288:n7lw1DxppifX9IiyO9KWz3d7ysgfBnnl2Rx:n7m1DO3yO9KWz3lysgpnncP

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • RevengeRat Executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ec4184027a7bd0a061cdbca475d3217_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5ec4184027a7bd0a061cdbca475d3217_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe
      C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe -install -176337 -dcu -54bcba117b144f12b8d8e2e5ef5023a6 - -noJS -gwtfgxuvgilsrhcg -327828
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\OCS\gwtfgxuvgilsrhcg.dat

    Filesize

    25B

    MD5

    0a3f15c0799a6131415052bca7a1240f

    SHA1

    55db59d7918eb56a8f0619c18abea844d8d1ac20

    SHA256

    b195bce571a284d6402cd66e09cfcd82f09e15e28c997205ee3cc6fde87cff59

    SHA512

    b5762f1f2d27d488ee445cf9d3354e297ea2502849cb6453bc5a766932bd9953b33c77690bad2d38d1c4043ce752063ca1722760f355373091eabafe3eb1bd81

  • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe

    Filesize

    288KB

    MD5

    ea3ccd42dbdc3500e3888daf53d8ef5d

    SHA1

    848c686280eaa04b172fccffbd312132a0c46172

    SHA256

    cd166eede0e0e5303fc3f5fe5f0dd44999020f116bde2adea15319cc214751b5

    SHA512

    7126ec10c2301354f32f3f813958c61eaef63fe946b804ebd6f5934068b344ab75857886d867373f7a2ccf47f18a5a0f1dbe652e9649963a9fdea2b3de6dba50

  • memory/4520-11-0x000000001B420000-0x000000001B4C6000-memory.dmp

    Filesize

    664KB

  • memory/4520-16-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-9-0x000000001BA10000-0x000000001BEDE000-memory.dmp

    Filesize

    4.8MB

  • memory/4520-12-0x000000001BF80000-0x000000001C01C000-memory.dmp

    Filesize

    624KB

  • memory/4520-13-0x0000000000E40000-0x0000000000E48000-memory.dmp

    Filesize

    32KB

  • memory/4520-14-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-8-0x00007FF943235000-0x00007FF943236000-memory.dmp

    Filesize

    4KB

  • memory/4520-10-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-17-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-18-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-19-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-20-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-21-0x00007FF943235000-0x00007FF943236000-memory.dmp

    Filesize

    4KB

  • memory/4520-22-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-23-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB

  • memory/4520-25-0x00007FF942F80000-0x00007FF943921000-memory.dmp

    Filesize

    9.6MB