Analysis
-
max time kernel
95s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 07:23
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe
-
Size
598KB
-
MD5
0aa53de1afe4ab9de3a256dd627cf280
-
SHA1
992741e958ab5e246117b653cfa4eb1dc914be7f
-
SHA256
2bc26a50e4a769409d6ea04a4cc5b8c69415328eca2ac192431ba717d569080b
-
SHA512
56f7d060d3e69aaa8d74ddfd2b75e3f798f9f1acb6704f48de6e42945fca7a150c9183cc55df4af345cb4e340f11de69b7fe10f4a4d549c58ed29250fe306cd4
-
SSDEEP
6144:FKWlw1DxDaASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX27:F7lw1DxO5zfXeYU43fiysgfBnnl27
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023c84-6.dat revengerat -
Executes dropped EXE 1 IoCs
pid Process 4528 ocs_v71a.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4528 ocs_v71a.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4980 JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe 4528 ocs_v71a.exe 4528 ocs_v71a.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4528 4980 JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe 83 PID 4980 wrote to memory of 4528 4980 JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0aa53de1afe4ab9de3a256dd627cf280.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54394990 -chipde -c6a42280ef124743b13e206e3d939631 - -BLUB1 -uqcbwlxnldpcrsmb -3935742⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5317ec5f92cfbf04a53e8125b66b3b4af
SHA116068b8977b4dc562ae782d91bc009472667e331
SHA2567612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5
SHA512ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65
-
Filesize
81B
MD55463b779dffb1183bc335af81fdb1a78
SHA162c5764f4be978f2e44216b79cb7452b669f44f0
SHA2562cdc10e6099170ec5515c76e6a88d03aa42a2fcd4c37468738987b81598323df
SHA512653a2ab90eab2dc14f41714261630d5e121a591f32b1c8552d9aa9434f62c0d11783836946d3ffdd91d85f4e9b5092242072241a4594f735a83c325ea0b128d7