Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 17:14
Static task
static1
Behavioral task
behavioral1
Sample
189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe
-
Size
408KB
-
MD5
189ada9dc9ca6a101df62effdaf4e733
-
SHA1
b8be1b171a1b8b63706ca450f8fee514fc925b6d
-
SHA256
34e3b6a0dae2cc223bf18e7cb9c84c0cafead62b3d8914a9488de9f5c76d8794
-
SHA512
ecfdf797a8cf4316c786cd56fd6e7431529b985b446b9d388797b070fb4bba6ff4f6eeed6c488b42c8dfc584d1e5e94f5c53dcc550d02b401dd463b34fb06312
-
SSDEEP
12288:ikRCRTrqXyp0uqyNlz7n7SEQ8eskJKKP:FRCRT+CKNKlXi7i
Malware Config
Extracted
trickbot
1000213
jim252
138.34.32.218:443
86.61.177.139:443
188.124.167.132:449
93.109.242.134:443
62.31.150.202:443
158.58.131.54:443
36.74.100.211:449
66.229.97.133:443
200.111.167.227:449
109.86.227.152:443
85.172.38.59:449
67.162.236.158:443
66.232.212.59:443
80.53.57.146:443
182.253.210.130:449
155.133.31.21:449
176.222.255.2:443
209.121.142.202:449
138.34.32.74:443
209.121.142.214:449
144.48.51.8:443
199.250.230.169:443
92.53.66.78:443
195.54.163.93:443
185.159.129.78:443
185.174.172.249:443
109.234.37.52:443
37.46.135.218:443
94.103.82.239:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 7 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2056-3-0x0000000000400000-0x000000000043D000-memory.dmp trickbot_loader32 behavioral1/memory/2056-6-0x0000000000400000-0x000000000043D000-memory.dmp trickbot_loader32 behavioral1/memory/2056-22-0x0000000000400000-0x000000000043D000-memory.dmp trickbot_loader32 behavioral1/memory/2356-28-0x0000000000400000-0x000000000043D000-memory.dmp trickbot_loader32 behavioral1/memory/2356-42-0x0000000000400000-0x000000000043D000-memory.dmp trickbot_loader32 behavioral1/memory/1684-51-0x0000000000400000-0x000000000043D000-memory.dmp trickbot_loader32 behavioral1/memory/1684-63-0x0000000000400000-0x000000000043D000-memory.dmp trickbot_loader32 -
Executes dropped EXE 4 IoCs
Processes:
199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exepid process 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 752 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 1684 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe -
Loads dropped DLL 2 IoCs
Processes:
189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exepid process 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 myexternalip.com -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exedescription pid process target process PID 2240 set thread context of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2496 set thread context of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 752 set thread context of 1684 752 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2480 sc.exe 2508 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exepowershell.exepid process 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 2760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exedescription pid process Token: SeDebugPrivilege 2760 powershell.exe Token: SeTcbPrivilege 1684 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exepid process 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 752 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.execmd.execmd.execmd.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exedescription pid process target process PID 2240 wrote to memory of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2240 wrote to memory of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2240 wrote to memory of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2240 wrote to memory of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2240 wrote to memory of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2240 wrote to memory of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2240 wrote to memory of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2240 wrote to memory of 2056 2240 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe PID 2056 wrote to memory of 2136 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2136 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2136 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2136 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2252 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2252 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2252 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2252 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2900 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2900 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2900 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2900 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe cmd.exe PID 2056 wrote to memory of 2496 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2056 wrote to memory of 2496 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2056 wrote to memory of 2496 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2056 wrote to memory of 2496 2056 189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2136 wrote to memory of 2508 2136 cmd.exe sc.exe PID 2136 wrote to memory of 2508 2136 cmd.exe sc.exe PID 2136 wrote to memory of 2508 2136 cmd.exe sc.exe PID 2136 wrote to memory of 2508 2136 cmd.exe sc.exe PID 2252 wrote to memory of 2480 2252 cmd.exe sc.exe PID 2252 wrote to memory of 2480 2252 cmd.exe sc.exe PID 2252 wrote to memory of 2480 2252 cmd.exe sc.exe PID 2252 wrote to memory of 2480 2252 cmd.exe sc.exe PID 2900 wrote to memory of 2760 2900 cmd.exe powershell.exe PID 2900 wrote to memory of 2760 2900 cmd.exe powershell.exe PID 2900 wrote to memory of 2760 2900 cmd.exe powershell.exe PID 2900 wrote to memory of 2760 2900 cmd.exe powershell.exe PID 2496 wrote to memory of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2496 wrote to memory of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2496 wrote to memory of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2496 wrote to memory of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2496 wrote to memory of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2496 wrote to memory of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2496 wrote to memory of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2496 wrote to memory of 2356 2496 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe PID 2356 wrote to memory of 2832 2356 199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\189ada9dc9ca6a101df62effdaf4e733_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
PID:2508 -
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
PID:2480 -
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Users\Admin\AppData\Roaming\netlibs\199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\netlibs\199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Roaming\netlibs\199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\netlibs\199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:2832
-
C:\Windows\system32\taskeng.exetaskeng.exe {4DB7DF49-5339-4959-AEC8-6C0D18D0C2C7} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1472
-
C:\Users\Admin\AppData\Roaming\netlibs\199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\netlibs\199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:752 -
C:\Users\Admin\AppData\Roaming\netlibs\199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\netlibs\199ada9dc9ca7a101df72effdaf4e833_KaffaDaket119.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5a5aba000b6e6970eab73a5ae677b83b5
SHA16b1932b175871c8d59e8c98566419d78dcdc1372
SHA25622012823e1e942f88c90b1ecb85316e72807dd6ca9d5d2602a74c1be49a2e4ed
SHA512ef4af25d403df9d33a9cf3090f76a647be9e11627523cf2cb4b7886b9f9b42f93f43446578d787bb6203c85c76913f2e5906d6c512bcaf6b2f85418e2fb31db2
-
Filesize
408KB
MD5189ada9dc9ca6a101df62effdaf4e733
SHA1b8be1b171a1b8b63706ca450f8fee514fc925b6d
SHA25634e3b6a0dae2cc223bf18e7cb9c84c0cafead62b3d8914a9488de9f5c76d8794
SHA512ecfdf797a8cf4316c786cd56fd6e7431529b985b446b9d388797b070fb4bba6ff4f6eeed6c488b42c8dfc584d1e5e94f5c53dcc550d02b401dd463b34fb06312