Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2025, 13:32

General

  • Target

    JaffaCakes118_e5815370f9ee53658b44517b23d1b50f.exe

  • Size

    31KB

  • MD5

    e5815370f9ee53658b44517b23d1b50f

  • SHA1

    f7a8135350750dfb57326408ec8d8e923225f8ef

  • SHA256

    51c7f171a9d281863968bbb23445398d9a2285a094b8d204d5ac2efda7e23738

  • SHA512

    6c6a430b48fc9baa156b02f94385177d8b3f44192816221891300f6f752dcad4f158e8a73e8a889702a02746f9af0874e2807f9ebd358e98c39b948567ab121a

  • SSDEEP

    768:8SgW1Fbzu/t8I1J//VRPKLsStY/PXdEtOn4hC3b:8Sl8yIL3VRPK1CtT

Score
10/10

Malware Config

Extracted

Family

revengerat

Mutex

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e5815370f9ee53658b44517b23d1b50f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e5815370f9ee53658b44517b23d1b50f.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1512-0-0x00007FF849E15000-0x00007FF849E16000-memory.dmp

    Filesize

    4KB

  • memory/1512-1-0x00007FF849B60000-0x00007FF84A501000-memory.dmp

    Filesize

    9.6MB

  • memory/1512-2-0x0000000000C00000-0x0000000000C06000-memory.dmp

    Filesize

    24KB

  • memory/1512-3-0x00007FF849B60000-0x00007FF84A501000-memory.dmp

    Filesize

    9.6MB

  • memory/1512-4-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

    Filesize

    32KB

  • memory/1512-5-0x000000001BC40000-0x000000001C10E000-memory.dmp

    Filesize

    4.8MB

  • memory/1512-6-0x000000001C110000-0x000000001C1B6000-memory.dmp

    Filesize

    664KB

  • memory/1512-7-0x000000001C1C0000-0x000000001C222000-memory.dmp

    Filesize

    392KB

  • memory/1512-8-0x00007FF849E15000-0x00007FF849E16000-memory.dmp

    Filesize

    4KB

  • memory/1512-9-0x00007FF849B60000-0x00007FF84A501000-memory.dmp

    Filesize

    9.6MB