Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2025, 04:08

General

  • Target

    JaffaCakes118_628fa3a00ba4f280adfcc495d0d39d30.exe

  • Size

    600KB

  • MD5

    628fa3a00ba4f280adfcc495d0d39d30

  • SHA1

    f455f1efad13018d57e4ae949eb150d8de08acda

  • SHA256

    095dfb868e9b79a8e1bed56a4bdbfda5e16e17cf0500e448fb4989752dbc6bea

  • SHA512

    f56ab64e585922f4ee5b6262e5343513939b11ffe62ce5fbad7fc5260bd74f0dc2848d66497e9e2902c879396e5683ca30e9ba52e7f1f1262910f319661e90b8

  • SSDEEP

    12288:G7lw1DxHpifX9IiyO9KWz3d7ysgfBnnl2jP:G7m1D43yO9KWz3lysgpnncD

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • RevengeRat Executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_628fa3a00ba4f280adfcc495d0d39d30.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_628fa3a00ba4f280adfcc495d0d39d30.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe
      C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe -install -54383364 -chipde -3754cd5e576f4172abc8502570387c25 - -ABdetected -wjdpopvnxitsouff -393564
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\OCS\wjdpopvnxitsouff.dat

    Filesize

    81B

    MD5

    a81c2b8823dea6c9515256712109fe0f

    SHA1

    cc92a77940d00767d4cfff0e550e5e5cf4bcfd09

    SHA256

    519edd85016c186bd44d2d6ead2e2425d8ccc03992384a2c46e5a9e2d263f30f

    SHA512

    a4e1ce7b74158efba620f35028e1f4e1fb75bcdf197f2fafb71f76815b34c9b8391b499548028b81ab022eefed9636c96b0f1d5607bc19b435aae1d920122c26

  • \Users\Admin\AppData\Local\Temp\OCS\ocs_v7f.exe

    Filesize

    288KB

    MD5

    ea3ccd42dbdc3500e3888daf53d8ef5d

    SHA1

    848c686280eaa04b172fccffbd312132a0c46172

    SHA256

    cd166eede0e0e5303fc3f5fe5f0dd44999020f116bde2adea15319cc214751b5

    SHA512

    7126ec10c2301354f32f3f813958c61eaef63fe946b804ebd6f5934068b344ab75857886d867373f7a2ccf47f18a5a0f1dbe652e9649963a9fdea2b3de6dba50

  • memory/1100-17-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-13-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-15-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-16-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-12-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

    Filesize

    4KB

  • memory/1100-18-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-19-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-20-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-21-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-22-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

    Filesize

    4KB

  • memory/1100-23-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB

  • memory/1100-24-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

    Filesize

    9.6MB