Analysis
-
max time kernel
137s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 16:58
Static task
static1
Behavioral task
behavioral1
Sample
0828f63b9396fead9231cae937694a37_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
0828f63b9396fead9231cae937694a37_JaffaCakes118.dll
-
Size
304KB
-
MD5
0828f63b9396fead9231cae937694a37
-
SHA1
66f370b3a1dcfb9c87a31b35d2c0951a3b1612f8
-
SHA256
fdfb6706e3f056404da1928a1a8dc3bce4ab4b8473f49e1c246b4ab2edc69ad4
-
SHA512
dc34118892dfb58d22e888818b06c3f67307261238fb96eb9d75a2a2d88e761c07295cb6706a6783795d8365251bed83e91f1631cc86ca8ae16113156c561256
-
SSDEEP
3072:Uz/9xlxG5uQ5qPfKUwUS6pRBdHQwlaAwgQegMjA3k30qSeLZerTCC0NBSNka9Jvo:2NG51UrS6pRBdwwlaDe3EqSedAWU2as
Malware Config
Extracted
trickbot
1000514
ono76
51.89.163.40:443
89.223.126.186:443
45.67.231.68:443
148.251.185.165:443
194.87.110.144:443
213.32.84.27:443
185.234.72.35:443
45.89.125.148:443
195.123.240.104:443
185.99.2.243:443
5.182.211.223:443
195.123.240.113:443
85.204.116.173:443
5.152.210.188:443
103.36.48.103:449
36.94.33.102:449
36.91.87.227:449
177.190.69.162:449
103.76.169.213:449
179.97.246.23:449
200.24.67.161:449
181.143.186.42:449
190.99.97.42:449
179.127.88.41:449
117.252.214.138:449
117.222.63.145:449
45.224.213.234:449
45.237.241.97:449
125.165.20.104:449
-
autorunName:pwgrab
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2992-0-0x00000000002C0000-0x00000000002F7000-memory.dmp templ_dll behavioral1/memory/2992-4-0x00000000022D0000-0x0000000002306000-memory.dmp templ_dll behavioral1/memory/2992-7-0x0000000000200000-0x0000000000235000-memory.dmp templ_dll -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2852 wermgr.exe Token: SeDebugPrivilege 2852 wermgr.exe Token: SeDebugPrivilege 2852 wermgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2928 wrote to memory of 2992 2928 regsvr32.exe regsvr32.exe PID 2928 wrote to memory of 2992 2928 regsvr32.exe regsvr32.exe PID 2928 wrote to memory of 2992 2928 regsvr32.exe regsvr32.exe PID 2928 wrote to memory of 2992 2928 regsvr32.exe regsvr32.exe PID 2928 wrote to memory of 2992 2928 regsvr32.exe regsvr32.exe PID 2928 wrote to memory of 2992 2928 regsvr32.exe regsvr32.exe PID 2928 wrote to memory of 2992 2928 regsvr32.exe regsvr32.exe PID 2992 wrote to memory of 2852 2992 regsvr32.exe wermgr.exe PID 2992 wrote to memory of 2852 2992 regsvr32.exe wermgr.exe PID 2992 wrote to memory of 2852 2992 regsvr32.exe wermgr.exe PID 2992 wrote to memory of 2852 2992 regsvr32.exe wermgr.exe PID 2992 wrote to memory of 2852 2992 regsvr32.exe wermgr.exe PID 2992 wrote to memory of 2852 2992 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0828f63b9396fead9231cae937694a37_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0828f63b9396fead9231cae937694a37_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2852-13-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2852-14-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB
-
memory/2852-16-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB
-
memory/2992-0-0x00000000002C0000-0x00000000002F7000-memory.dmpFilesize
220KB
-
memory/2992-4-0x00000000022D0000-0x0000000002306000-memory.dmpFilesize
216KB
-
memory/2992-7-0x0000000000200000-0x0000000000235000-memory.dmpFilesize
212KB
-
memory/2992-8-0x00000000025F0000-0x0000000002631000-memory.dmpFilesize
260KB
-
memory/2992-9-0x0000000002820000-0x000000000297C000-memory.dmpFilesize
1.4MB
-
memory/2992-11-0x00000000025F0000-0x0000000002631000-memory.dmpFilesize
260KB
-
memory/2992-12-0x0000000000140000-0x0000000000143000-memory.dmpFilesize
12KB
-
memory/2992-15-0x00000000025F0000-0x0000000002631000-memory.dmpFilesize
260KB