Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    01-05-2024 15:19

General

  • Target

    0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe

  • Size

    516KB

  • MD5

    0c22a5b5e552e17e9123d6d3a001604d

  • SHA1

    3fa7b3d0173b2b0830cd8492dcc4326b0adfb3e6

  • SHA256

    34c7b8b5f3db11cd187d77f7aaf6c793393e79c43e47132336a93c2f27f6616e

  • SHA512

    b2e525893399634a90405f510a309958e5869676f62b57c1ff479164723c58bea94b08abc73e02e974f63f2170eb43cb961f0707218c0fa6e0c32c1e8815c490

  • SSDEEP

    6144:/35ocLj+YnHobxOYzbTaquUQpQwIyKL9PA9o13/OvVDye0dbP:v+KHUnb1uUpwuFAyhOdGT

Malware Config

Extracted

Family

trickbot

Version

1000293

Botnet

tot346

C2

51.68.170.58:443

68.3.14.71:443

174.105.235.178:449

195.54.162.247:443

181.113.17.230:449

174.105.233.82:449

66.60.121.58:449

207.140.14.141:443

42.115.91.177:443

5.189.224.254:443

71.94.101.25:443

206.130.141.255:449

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

75.102.135.23:449

24.119.69.70:449

85.143.223.51:443

103.110.91.118:449

68.4.173.10:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 3 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\SysWOW64\cmd.exe
      /c sc stop WinDefend
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\SysWOW64\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        PID:2628
    • C:\Windows\SysWOW64\cmd.exe
      /c sc delete WinDefend
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\SysWOW64\sc.exe
        sc delete WinDefend
        3⤵
        • Launches sc.exe
        PID:2632
    • C:\Windows\SysWOW64\cmd.exe
      /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2604
    • C:\Users\Admin\AppData\Roaming\WSIGE\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe
      C:\Users\Admin\AppData\Roaming\WSIGE\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2108
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {7C77231E-F896-4F4B-8592-C25C00479160} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
        PID:1320
        • C:\Users\Admin\AppData\Roaming\WSIGE\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe
          C:\Users\Admin\AppData\Roaming\WSIGE\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1376
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe
            3⤵
            • Modifies data under HKEY_USERS
            PID:2944

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Roaming\WSIGE\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe

        Filesize

        516KB

        MD5

        0c22a5b5e552e17e9123d6d3a001604d

        SHA1

        3fa7b3d0173b2b0830cd8492dcc4326b0adfb3e6

        SHA256

        34c7b8b5f3db11cd187d77f7aaf6c793393e79c43e47132336a93c2f27f6616e

        SHA512

        b2e525893399634a90405f510a309958e5869676f62b57c1ff479164723c58bea94b08abc73e02e974f63f2170eb43cb961f0707218c0fa6e0c32c1e8815c490

      • memory/1376-70-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-72-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-73-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-75-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-76-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-78-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-79-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-80-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-81-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-77-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-74-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-71-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-69-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1376-68-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/2108-56-0x0000000140000000-0x0000000140039000-memory.dmp

        Filesize

        228KB

      • memory/2108-57-0x0000000140000000-0x0000000140039000-memory.dmp

        Filesize

        228KB

      • memory/2392-7-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-2-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-3-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-34-0x0000000000280000-0x00000000002C0000-memory.dmp

        Filesize

        256KB

      • memory/2392-17-0x0000000000280000-0x00000000002C0000-memory.dmp

        Filesize

        256KB

      • memory/2392-15-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-21-0x0000000000280000-0x00000000002C0000-memory.dmp

        Filesize

        256KB

      • memory/2392-20-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-19-0x0000000000400000-0x0000000000487000-memory.dmp

        Filesize

        540KB

      • memory/2392-4-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-14-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-13-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-12-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-11-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-10-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-9-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-8-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-16-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-6-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2392-5-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2696-41-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-46-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-47-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-48-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-49-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-52-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/2696-53-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/2696-37-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-38-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-39-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-40-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-42-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-43-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-44-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-45-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2696-36-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB