Analysis
-
max time kernel
148s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 09:19
Behavioral task
behavioral1
Sample
JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe
-
Size
557KB
-
MD5
e09299678134a7eec29bbd86d054fda6
-
SHA1
1a03a3d92259f3f7d46f01aec44722cdc4b922a9
-
SHA256
7e167798805bdee5d4d866d6cb0318d6469f928d6a48fb810ada076de4f3c5aa
-
SHA512
6661eee555393fc2c3362b3d1135b207760b48840a85e4ef3277df33247cea4804408b8e3f5d681b5b8a64350f14db57f30c897c7853a16ba030c25d7ebba06b
-
SSDEEP
12288:apkiIqsCqaXTa+dD2m4JZUXy7NlW0EJRz:apkEsHf+dCm7cNlWDJ
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral1/files/0x0003000000012000-6.dat revengerat -
Executes dropped EXE 2 IoCs
pid Process 2544 Courses.exe 1580 63629726.exe -
Loads dropped DLL 3 IoCs
pid Process 2124 JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe 2124 JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe 2544 Courses.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Course = "C:\\Users\\Admin\\AppData\\Roaming\\Courses.exe" Courses.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Courses.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63629726.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2124 JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe Token: SeDebugPrivilege 2544 Courses.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2544 2124 JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe 30 PID 2124 wrote to memory of 2544 2124 JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe 30 PID 2124 wrote to memory of 2544 2124 JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe 30 PID 2124 wrote to memory of 2544 2124 JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe 30 PID 2544 wrote to memory of 1580 2544 Courses.exe 31 PID 2544 wrote to memory of 1580 2544 Courses.exe 31 PID 2544 wrote to memory of 1580 2544 Courses.exe 31 PID 2544 wrote to memory of 1580 2544 Courses.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e09299678134a7eec29bbd86d054fda6.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Roaming\Courses.exe"C:\Users\Admin\AppData\Roaming\Courses.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\63629726.exe"C:\Users\Admin\AppData\Local\Temp\63629726.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
297KB
MD59e83fc421f54556e8346544016317cf5
SHA16bdb0fce8e014c34e9d9f03c8d650bacaf13ef64
SHA256faa7a5f9a4fdc9e396cc6654b39ac01bf2c51bc73322e2ac11127137325e6bfa
SHA51282cbbcb8ffc8c4b8498cb3280830ee73fa7f25bf07ae54d9cdf3f34198640093681c9a875e8df92f919c5185caae772f29f2a19341ed4b77a0f3291bfb440387
-
Filesize
557KB
MD5e09299678134a7eec29bbd86d054fda6
SHA11a03a3d92259f3f7d46f01aec44722cdc4b922a9
SHA2567e167798805bdee5d4d866d6cb0318d6469f928d6a48fb810ada076de4f3c5aa
SHA5126661eee555393fc2c3362b3d1135b207760b48840a85e4ef3277df33247cea4804408b8e3f5d681b5b8a64350f14db57f30c897c7853a16ba030c25d7ebba06b