Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2024 16:56

General

  • Target

    0c54d2ae9c14efbcbbb00400970f1882_JaffaCakes118.exe

  • Size

    848KB

  • MD5

    0c54d2ae9c14efbcbbb00400970f1882

  • SHA1

    a81d4f9f8ac30ea98557e09e9a7097a7560dc288

  • SHA256

    2df19babfd77debddaca213c48022b200593b478afc1907bbe6a2b31c439f0b0

  • SHA512

    71593244ae73e3318f9974f408164fa9a80537f293f0f5cff8cb92893d4362a842bacc81a6ace747969ef68573a5ad9d4f435eb13b4824403f9f16b3379e2b0e

  • SSDEEP

    12288:YMgdE74Qo2aKplFAuL1Xt/jV6ZmFwDrr74jVr/b6tE67cEFpb4Re7:YMg8Pd9b/pSewD37yr/WE67cEnERS

Score
10/10

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c54d2ae9c14efbcbbb00400970f1882_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0c54d2ae9c14efbcbbb00400970f1882_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Users\Admin\AppData\Roaming\cleanmem\0c65d2ae9c15efbcbbb00500980f1992_KaffaDalet119.exe
      C:\Users\Admin\AppData\Roaming\cleanmem\0c65d2ae9c15efbcbbb00500980f1992_KaffaDalet119.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3668
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2560
    • C:\Users\Admin\AppData\Roaming\cleanmem\0c65d2ae9c15efbcbbb00500980f1992_KaffaDalet119.exe
      C:\Users\Admin\AppData\Roaming\cleanmem\0c65d2ae9c15efbcbbb00500980f1992_KaffaDalet119.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:1520

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\cleanmem\0c65d2ae9c15efbcbbb00500980f1992_KaffaDalet119.exe

        Filesize

        848KB

        MD5

        0c54d2ae9c14efbcbbb00400970f1882

        SHA1

        a81d4f9f8ac30ea98557e09e9a7097a7560dc288

        SHA256

        2df19babfd77debddaca213c48022b200593b478afc1907bbe6a2b31c439f0b0

        SHA512

        71593244ae73e3318f9974f408164fa9a80537f293f0f5cff8cb92893d4362a842bacc81a6ace747969ef68573a5ad9d4f435eb13b4824403f9f16b3379e2b0e

      • memory/2560-49-0x0000000010000000-0x0000000010020000-memory.dmp

        Filesize

        128KB

      • memory/2560-54-0x000001F7B6D70000-0x000001F7B6D71000-memory.dmp

        Filesize

        4KB

      • memory/2560-48-0x0000000010000000-0x0000000010020000-memory.dmp

        Filesize

        128KB

      • memory/2920-19-0x0000000000400000-0x00000000004D7000-memory.dmp

        Filesize

        860KB

      • memory/2920-18-0x000000000041D000-0x000000000041E000-memory.dmp

        Filesize

        4KB

      • memory/2920-16-0x0000000003020000-0x000000000304B000-memory.dmp

        Filesize

        172KB

      • memory/2920-15-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-14-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-13-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-12-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-11-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-10-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-9-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-8-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-7-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-6-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-5-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-4-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/2920-3-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/3668-33-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-39-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-38-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-44-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/3668-43-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/3668-42-0x0000000000400000-0x00000000004D7000-memory.dmp

        Filesize

        860KB

      • memory/3668-53-0x0000000003140000-0x00000000031FE000-memory.dmp

        Filesize

        760KB

      • memory/3668-56-0x0000000002A70000-0x0000000002A71000-memory.dmp

        Filesize

        4KB

      • memory/3668-55-0x0000000003200000-0x00000000034C9000-memory.dmp

        Filesize

        2.8MB

      • memory/3668-37-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-36-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-35-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-34-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-32-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-31-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-30-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-29-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/3668-28-0x0000000002190000-0x0000000002191000-memory.dmp

        Filesize

        4KB

      • memory/4360-63-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-64-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-65-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-67-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-69-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-73-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-72-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-71-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-70-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-68-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-66-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-62-0x0000000000D20000-0x0000000000D21000-memory.dmp

        Filesize

        4KB

      • memory/4360-76-0x000000000041D000-0x000000000041E000-memory.dmp

        Filesize

        4KB

      • memory/4360-77-0x0000000000400000-0x00000000004D7000-memory.dmp

        Filesize

        860KB