Analysis
- max time kernel
12s - max time network
14s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
05/05/2024, 02:08
Errors
General
- Target 14baf40f53594c5abd14d2f6d87caf83_JaffaCakes118.exe
- Size 468KB
- Sample240505-ckwblsee87
- SHA256 1d0fc0a8457031236be2041236865a40bb1838fc445fe7f235b6f58a6026dfea
Malware Config
Signatures
- Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14baf40f53594c5abd14d2f6d87caf83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14baf40f53594c5abd14d2f6d87caf83_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3961855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4036-3-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-15-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-14-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-17-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-16-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-13-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-12-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-11-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-10-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-9-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-8-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-7-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-6-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-5-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-4-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/4036-18-0x0000000002BE0000-0x0000000002C13000-memory.dmp
memory/4036-20-0x0000000000439000-0x000000000043A000-memory.dmp
memory/4036-21-0x0000000000400000-0x0000000000477000-memory.dmp