Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 04:49
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_8e57e91b007a4aea044f90adce393d0a78465d62df8f70a4022f5a4533c3fd65.msi
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_8e57e91b007a4aea044f90adce393d0a78465d62df8f70a4022f5a4533c3fd65.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
JaffaCakes118_8e57e91b007a4aea044f90adce393d0a78465d62df8f70a4022f5a4533c3fd65.msi
-
Size
288KB
-
MD5
f959677f1823dff599d226429d95c0e6
-
SHA1
02b546733236c788dec7c680ec38afa03dc5960d
-
SHA256
8e57e91b007a4aea044f90adce393d0a78465d62df8f70a4022f5a4533c3fd65
-
SHA512
7e3781b42b4d2f7533523c986d0778a53ea7e995fa794c5196d49fe2229892519472cff53f6787b7a8c7f307dde0c58bd2be167b90f3c5b59a369796c3ba8547
-
SSDEEP
6144:GEKG/ZO3j4Tdo89lYaJNB0da/IWf9GVoMsCE4U78tSYX6wD:GEBZO2dRlYUNidhWf2ovL7AX
Malware Config
Extracted
Family
revengerat
Botnet
Nov333
C2
80.82.68.21:3333
Mutex
RV_MUTEX-FtNHuiGGjjtnxDp
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
resource yara_rule behavioral1/memory/2208-13-0x0000000000410000-0x000000000044C000-memory.dmp beds_protector -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSI8FA4.tmp.exe MSI8FA4.tmp File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSI8FA4.tmp.exe MSI8FA4.tmp -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2208 set thread context of 1264 2208 MSI8FA4.tmp 35 -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f768ea9.msi msiexec.exe File opened for modification C:\Windows\Installer\f768ea9.msi msiexec.exe File opened for modification C:\Windows\Installer\f768eac.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8F73.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8FA4.tmp msiexec.exe File created C:\Windows\Installer\f768eac.ipi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 2208 MSI8FA4.tmp 1264 MSI8FA4.tmp -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2400 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI8FA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI8FA4.tmp -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2804 msiexec.exe 2804 msiexec.exe 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp 2208 MSI8FA4.tmp -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 2400 msiexec.exe Token: SeIncreaseQuotaPrivilege 2400 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeSecurityPrivilege 2804 msiexec.exe Token: SeCreateTokenPrivilege 2400 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2400 msiexec.exe Token: SeLockMemoryPrivilege 2400 msiexec.exe Token: SeIncreaseQuotaPrivilege 2400 msiexec.exe Token: SeMachineAccountPrivilege 2400 msiexec.exe Token: SeTcbPrivilege 2400 msiexec.exe Token: SeSecurityPrivilege 2400 msiexec.exe Token: SeTakeOwnershipPrivilege 2400 msiexec.exe Token: SeLoadDriverPrivilege 2400 msiexec.exe Token: SeSystemProfilePrivilege 2400 msiexec.exe Token: SeSystemtimePrivilege 2400 msiexec.exe Token: SeProfSingleProcessPrivilege 2400 msiexec.exe Token: SeIncBasePriorityPrivilege 2400 msiexec.exe Token: SeCreatePagefilePrivilege 2400 msiexec.exe Token: SeCreatePermanentPrivilege 2400 msiexec.exe Token: SeBackupPrivilege 2400 msiexec.exe Token: SeRestorePrivilege 2400 msiexec.exe Token: SeShutdownPrivilege 2400 msiexec.exe Token: SeDebugPrivilege 2400 msiexec.exe Token: SeAuditPrivilege 2400 msiexec.exe Token: SeSystemEnvironmentPrivilege 2400 msiexec.exe Token: SeChangeNotifyPrivilege 2400 msiexec.exe Token: SeRemoteShutdownPrivilege 2400 msiexec.exe Token: SeUndockPrivilege 2400 msiexec.exe Token: SeSyncAgentPrivilege 2400 msiexec.exe Token: SeEnableDelegationPrivilege 2400 msiexec.exe Token: SeManageVolumePrivilege 2400 msiexec.exe Token: SeImpersonatePrivilege 2400 msiexec.exe Token: SeCreateGlobalPrivilege 2400 msiexec.exe Token: SeBackupPrivilege 2444 vssvc.exe Token: SeRestorePrivilege 2444 vssvc.exe Token: SeAuditPrivilege 2444 vssvc.exe Token: SeBackupPrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2068 DrvInst.exe Token: SeRestorePrivilege 2068 DrvInst.exe Token: SeRestorePrivilege 2068 DrvInst.exe Token: SeRestorePrivilege 2068 DrvInst.exe Token: SeRestorePrivilege 2068 DrvInst.exe Token: SeRestorePrivilege 2068 DrvInst.exe Token: SeRestorePrivilege 2068 DrvInst.exe Token: SeLoadDriverPrivilege 2068 DrvInst.exe Token: SeLoadDriverPrivilege 2068 DrvInst.exe Token: SeLoadDriverPrivilege 2068 DrvInst.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeDebugPrivilege 2208 MSI8FA4.tmp Token: SeDebugPrivilege 1264 MSI8FA4.tmp Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2400 msiexec.exe 2400 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2208 2804 msiexec.exe 34 PID 2804 wrote to memory of 2208 2804 msiexec.exe 34 PID 2804 wrote to memory of 2208 2804 msiexec.exe 34 PID 2804 wrote to memory of 2208 2804 msiexec.exe 34 PID 2208 wrote to memory of 1264 2208 MSI8FA4.tmp 35 PID 2208 wrote to memory of 1264 2208 MSI8FA4.tmp 35 PID 2208 wrote to memory of 1264 2208 MSI8FA4.tmp 35 PID 2208 wrote to memory of 1264 2208 MSI8FA4.tmp 35 PID 2208 wrote to memory of 1264 2208 MSI8FA4.tmp 35 PID 2208 wrote to memory of 1264 2208 MSI8FA4.tmp 35 PID 2208 wrote to memory of 1264 2208 MSI8FA4.tmp 35 PID 2208 wrote to memory of 1264 2208 MSI8FA4.tmp 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e57e91b007a4aea044f90adce393d0a78465d62df8f70a4022f5a4533c3fd65.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2400
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\Installer\MSI8FA4.tmp"C:\Windows\Installer\MSI8FA4.tmp"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\Installer\MSI8FA4.tmp"C:\Windows\Installer\MSI8FA4.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004D8" "00000000000003E8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD549d493901c396507a0d26065e4a75283
SHA10fa197bf3b50ca8a6b6be01283e6ba1eebcc7889
SHA256c04888cf051d59540208dc4e13c7b32366f131d095e50bd97c2c8fbff91c07c3
SHA512a72ed9410f8fcedd6ea63a5eab84174ad78a397155238651de35c0cd69060f1bc51219430955929753a3fe8347abc0ebdf544d55f452930deab7fa99ff2fc711