Analysis
-
max time kernel
111s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 15:19
Static task
static1
Behavioral task
behavioral1
Sample
0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe
-
Size
516KB
-
MD5
0c22a5b5e552e17e9123d6d3a001604d
-
SHA1
3fa7b3d0173b2b0830cd8492dcc4326b0adfb3e6
-
SHA256
34c7b8b5f3db11cd187d77f7aaf6c793393e79c43e47132336a93c2f27f6616e
-
SHA512
b2e525893399634a90405f510a309958e5869676f62b57c1ff479164723c58bea94b08abc73e02e974f63f2170eb43cb961f0707218c0fa6e0c32c1e8815c490
-
SSDEEP
6144:/35ocLj+YnHobxOYzbTaquUQpQwIyKL9PA9o13/OvVDye0dbP:v+KHUnb1uUpwuFAyhOdGT
Malware Config
Extracted
trickbot
1000293
tot346
51.68.170.58:443
68.3.14.71:443
174.105.235.178:449
195.54.162.247:443
181.113.17.230:449
174.105.233.82:449
66.60.121.58:449
207.140.14.141:443
42.115.91.177:443
5.189.224.254:443
71.94.101.25:443
206.130.141.255:449
74.140.160.33:449
65.31.241.133:449
140.190.54.187:449
75.102.135.23:449
24.119.69.70:449
85.143.223.51:443
103.110.91.118:449
68.4.173.10:443
72.189.124.41:449
103.111.53.126:449
105.27.171.234:449
182.253.20.66:449
199.182.59.42:449
71.193.151.218:443
46.149.182.112:449
82.146.56.24:443
199.227.126.250:449
24.113.161.184:449
197.232.50.85:443
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
73.67.78.5:449
67.49.38.139:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDllName:pwgrab
Signatures
-
Trickbot x86 loader 5 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/4568-17-0x0000000002890000-0x00000000028D0000-memory.dmp trickbot_loader32 behavioral2/memory/4568-21-0x0000000002890000-0x00000000028D0000-memory.dmp trickbot_loader32 behavioral2/memory/2880-47-0x0000000002B90000-0x0000000002BD0000-memory.dmp trickbot_loader32 behavioral2/memory/4568-53-0x0000000002890000-0x00000000028D0000-memory.dmp trickbot_loader32 behavioral2/memory/2880-65-0x0000000002B90000-0x0000000002BD0000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exepid process 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\WSIGE\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\WSIGE\\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe" svchost.exe -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 17 ipecho.net 18 ipinfo.io 5 icanhazip.com 11 api.ipify.org 14 ident.me 16 checkip.amazonaws.com -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exepid process 4568 0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exedescription pid process target process PID 4568 wrote to memory of 2880 4568 0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe PID 4568 wrote to memory of 2880 4568 0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe PID 4568 wrote to memory of 2880 4568 0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe PID 2880 wrote to memory of 4064 2880 0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0c22a5b5e552e17e9123d6d3a001604d_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Roaming\WSIGE\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\WSIGE\0c22a6b6e662e18e9123d7d3a001704d_KaffaDaket119.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Adds Run key to start application
PID:4064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516KB
MD50c22a5b5e552e17e9123d6d3a001604d
SHA13fa7b3d0173b2b0830cd8492dcc4326b0adfb3e6
SHA25634c7b8b5f3db11cd187d77f7aaf6c793393e79c43e47132336a93c2f27f6616e
SHA512b2e525893399634a90405f510a309958e5869676f62b57c1ff479164723c58bea94b08abc73e02e974f63f2170eb43cb961f0707218c0fa6e0c32c1e8815c490