Analysis
-
max time kernel
132s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 09:19
Static task
static1
Behavioral task
behavioral1
Sample
f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe
-
Size
568KB
-
MD5
f9fd9ab57f62b91a584574e7c5dca006
-
SHA1
862d7a91fa12610868f1bae6e8716b24de14920f
-
SHA256
9c31f43a0c48a56de0e30cbdf89f8d03dd6cf73b2c2ec392bf285830454ae444
-
SHA512
00263be3e9d78fa3810ba0908aaadf3504dea94edd3a6f113e8b0ceb996e9dbd725346f9b364f2cd99ffdead4e82659398c98406a7729821740c3cf4ff7c5e0b
-
SSDEEP
12288:1g1pjWbIFbFc0WkROi9D/oj5vbaF/3uGzchJAQficGw:1aQIFbFpQIToj9baFvbghJAfhw
Malware Config
Extracted
trickbot
2000032
tot130
103.122.228.44:443
196.216.220.211:443
181.114.215.239:443
41.57.156.203:443
43.252.159.63:443
197.156.129.250:443
113.160.37.196:443
38.110.100.64:443
113.160.132.237:443
24.28.12.23:443
38.110.100.219:443
45.239.233.109:443
119.202.8.249:443
200.236.218.62:443
220.82.64.198:443
190.93.208.53:443
196.216.59.174:443
222.124.16.74:443
202.165.47.106:443
96.9.77.56:443
49.248.217.170:443
186.225.119.170:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2440 4412 WerFault.exe f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 1580 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exepid process 4412 f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe 4412 f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exedescription pid process target process PID 4412 wrote to memory of 1580 4412 f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe wermgr.exe PID 4412 wrote to memory of 1580 4412 f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe wermgr.exe PID 4412 wrote to memory of 2228 4412 f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe cmd.exe PID 4412 wrote to memory of 2228 4412 f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe cmd.exe PID 4412 wrote to memory of 1580 4412 f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe wermgr.exe PID 4412 wrote to memory of 1580 4412 f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9fd9ab57f62b91a584574e7c5dca006_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 8482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4412 -ip 44121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1580-9-0x00000242930C0000-0x00000242930C1000-memory.dmpFilesize
4KB
-
memory/1580-10-0x0000024292F20000-0x0000024292F49000-memory.dmpFilesize
164KB
-
memory/1580-14-0x0000024292F20000-0x0000024292F49000-memory.dmpFilesize
164KB
-
memory/4412-1-0x0000000002360000-0x000000000239C000-memory.dmpFilesize
240KB
-
memory/4412-0-0x00000000024C0000-0x00000000024FE000-memory.dmpFilesize
248KB
-
memory/4412-5-0x0000000002500000-0x000000000253A000-memory.dmpFilesize
232KB
-
memory/4412-6-0x0000000002500000-0x000000000253A000-memory.dmpFilesize
232KB
-
memory/4412-7-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/4412-8-0x0000000010000000-0x0000000010003000-memory.dmpFilesize
12KB
-
memory/4412-12-0x0000000002500000-0x000000000253A000-memory.dmpFilesize
232KB
-
memory/4412-11-0x0000000002340000-0x0000000002353000-memory.dmpFilesize
76KB