Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    03-05-2024 01:18

General

  • Target

    0f575c5c33b03bfe52048b34260bf830_JaffaCakes118.exe

  • Size

    740KB

  • MD5

    0f575c5c33b03bfe52048b34260bf830

  • SHA1

    fedaafe20cef6373e2329496fb28255b3a16e720

  • SHA256

    432b4cbcdfaafd525d07e05fc07149098103e34c3ee6d423d1596e5342725d94

  • SHA512

    44372d1e7a43ed0868e6a0bf7caee3e3bee3224003acdbfc697891c22d0963e1ff49b8828170f95bd260e107f3b545d9d308dacd68dab93376ad7fbfcb687013

  • SSDEEP

    12288:53X+nxll0T7S4d+XMk4Fy2QHAC35lduV89Sr3ZUYHEUjROzfDa05lzCMNJMP0iLD:RuxV4d+XMkCyLzldE89tYHvVO3aH0iLD

Score
10/10

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 4 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f575c5c33b03bfe52048b34260bf830_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0f575c5c33b03bfe52048b34260bf830_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\ProgramData\÷ñâàìñàâé.exe
      "C:\ProgramData\÷ñâàìñàâé.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2660
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {3B5D4B69-02E0-4FCF-ACEE-B2DC4E9B8B8D} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Users\Admin\AppData\Roaming\gputask\÷ñâàìñàâé.exe
        C:\Users\Admin\AppData\Roaming\gputask\÷ñâàìñàâé.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1908

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \ProgramData\÷ñâàìñàâé.exe

      Filesize

      740KB

      MD5

      0f575c5c33b03bfe52048b34260bf830

      SHA1

      fedaafe20cef6373e2329496fb28255b3a16e720

      SHA256

      432b4cbcdfaafd525d07e05fc07149098103e34c3ee6d423d1596e5342725d94

      SHA512

      44372d1e7a43ed0868e6a0bf7caee3e3bee3224003acdbfc697891c22d0963e1ff49b8828170f95bd260e107f3b545d9d308dacd68dab93376ad7fbfcb687013

    • memory/2660-16-0x0000000000060000-0x0000000000082000-memory.dmp

      Filesize

      136KB

    • memory/2660-19-0x0000000000060000-0x0000000000082000-memory.dmp

      Filesize

      136KB

    • memory/2860-10-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2860-11-0x00000000003C0000-0x00000000003F0000-memory.dmp

      Filesize

      192KB

    • memory/2860-12-0x0000000000250000-0x000000000027F000-memory.dmp

      Filesize

      188KB

    • memory/2860-13-0x00000000003C0000-0x00000000003F0000-memory.dmp

      Filesize

      192KB

    • memory/2860-14-0x0000000000290000-0x0000000000291000-memory.dmp

      Filesize

      4KB

    • memory/2860-15-0x0000000010000000-0x0000000010005000-memory.dmp

      Filesize

      20KB

    • memory/2860-17-0x00000000003C0000-0x00000000003F0000-memory.dmp

      Filesize

      192KB