trickbot | 12fb64c38d06802aa80fefb80c7f21431c5377d060201550853eb5d7a054fe51

General

Target

22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe
Size

508KB
MD5

22161c0055fc01c0eca69127341c3e57
SHA1

f9cba47d308c75bc02b4b15e757fd059e975de2a
SHA256

12fb64c38d06802aa80fefb80c7f21431c5377d060201550853eb5d7a054fe51
SHA512

4bd932ba64dc4a5126cea52311f019b204d07f5221d3eddefa3444b9b4d628c630076c25443833d63f598bb95250a3c698e0d75ecd58313b8e658881fda36f84
SSDEEP

6144:AIpmP7lVNrtSPQFUPJVRMgBT4TSnOsAtYBPfWdgyJHBZ67SnSEnV29vwvlC:hwlVNrgyAVugBTIO+t6fatBDOmlC

Score

10^/10

trickbot lib372 banker evasion execution trojan

Malware Config

Extracted

Family

trickbot

Version

1000316

Botnet

lib372

C2

104.168.58.38:443

24.247.181.155:449

24.247.182.39:449

107.174.34.202:443

24.247.182.29:449

24.247.182.179:449

198.46.131.164:443

74.132.135.120:449

198.46.160.217:443

71.94.101.25:443

24.247.182.225:449

192.3.52.107:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

108.160.196.130:449

89.46.222.239:443

24.247.182.174:449

108.174.60.161:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/1040-17-0x0000000002DD0000-0x0000000002E10000-memory.dmp	trickbot_loader32

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 2 IoCs

Processes:

22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe

pid process

2588 22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
2200 22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
Loads dropped DLL 2 IoCs

Processes:

22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe

pid process

1040 22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe
1040 22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org

pid	process
2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
2200	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

Drops file in System32 directory 7 IoCs

Processes:

powershell.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	svchost.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

2396 sc.exe
2684 sc.exe

pid	process
2396	sc.exe
2684	sc.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exepowershell.exe

pid	process
1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe
1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe
1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe
2792	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exe22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe

description pid process

Token: SeDebugPrivilege 2792 powershell.exe
Token: SeTcbPrivilege 2200 22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe

description	pid	process
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeTcbPrivilege	2200	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe

pid	process
1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe
2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
2200	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

22161c0055fc01c0eca69127341c3e57_JaffaCakes118.execmd.execmd.execmd.exe22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe

description	pid	process	target process
PID 1040 wrote to memory of 2580	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2580	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2580	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2580	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2584	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2584	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2584	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2584	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2564	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2564	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2564	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2564	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	cmd.exe
PID 1040 wrote to memory of 2588	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
PID 1040 wrote to memory of 2588	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
PID 1040 wrote to memory of 2588	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
PID 1040 wrote to memory of 2588	1040	22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
PID 2584 wrote to memory of 2396	2584	cmd.exe	sc.exe
PID 2584 wrote to memory of 2396	2584	cmd.exe	sc.exe
PID 2584 wrote to memory of 2396	2584	cmd.exe	sc.exe
PID 2584 wrote to memory of 2396	2584	cmd.exe	sc.exe
PID 2580 wrote to memory of 2684	2580	cmd.exe	sc.exe
PID 2580 wrote to memory of 2684	2580	cmd.exe	sc.exe
PID 2580 wrote to memory of 2684	2580	cmd.exe	sc.exe
PID 2580 wrote to memory of 2684	2580	cmd.exe	sc.exe
PID 2564 wrote to memory of 2792	2564	cmd.exe	powershell.exe
PID 2564 wrote to memory of 2792	2564	cmd.exe	powershell.exe
PID 2564 wrote to memory of 2792	2564	cmd.exe	powershell.exe
PID 2564 wrote to memory of 2792	2564	cmd.exe	powershell.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe
PID 2588 wrote to memory of 2424	2588	22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22161c0055fc01c0eca69127341c3e57_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
3⤵
- Launches sc.exe
PID:2684

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
2⤵
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
3⤵
- Launches sc.exe
PID:2396

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Users\Admin\AppData\Roaming\WinDefrag\22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\WinDefrag\22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2424

C:\Windows\system32\taskeng.exe
taskeng.exe {0C03313C-F27D-4395-8F59-8A970E8361C6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2400

C:\Users\Admin\AppData\Roaming\WinDefrag\22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\WinDefrag\22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
75b23e902dea213531e8696849a9a0f8

SHA1
2193c58ba58ccf018fd81ef5b7375a2e15549586

SHA256
ceb4315cbd92fb23393da577988f513af33ab71456a1ee0514d1c2b895074c1c

SHA512
9a7de177e08fe4d16041c6b36a98ece655ef3eac37610b07a316925b463a5f8620e57e2d9eb3a6159e15b957836085b48e51829bdd90f2407d94af13a102716c

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
41831c1726c1a7a6b37ddf2179aa5d81

SHA1
0e72ceeee3f022a6a46ad10ee5815a03b932c372

SHA256
ebab56392c91414d92bedca95ce7d3249b7e7ee0d458a72192144008c0ef82c2

SHA512
b6e18936c74bd2c1e4da8432c2ef495448d28616a70e4cd3aefd8d1737c076b88d13f75270321c77b7ef5c90c1b156d4f175ca39cb621f379d4a018d833b880c

Download Submit
C:\Windows\Temp\CabD0B9.tmp
Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarD237.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Roaming\WinDefrag\22171c0066fc01c0eca79128341c3e68_KaffaDaket119.exe
Filesize
508KB

MD5
22161c0055fc01c0eca69127341c3e57

SHA1
f9cba47d308c75bc02b4b15e757fd059e975de2a

SHA256
12fb64c38d06802aa80fefb80c7f21431c5377d060201550853eb5d7a054fe51

SHA512
4bd932ba64dc4a5126cea52311f019b204d07f5221d3eddefa3444b9b4d628c630076c25443833d63f598bb95250a3c698e0d75ecd58313b8e658881fda36f84

Download Submit
memory/1040-17-0x0000000002DD0000-0x0000000002E10000-memory.dmp

Filesize
256KB

Download
memory/1040-7-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-14-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-13-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-12-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-11-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-10-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-9-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-8-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-15-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-6-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-16-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-2-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-19-0x0000000000433000-0x0000000000434000-memory.dmp

Filesize
4KB

Download
memory/1040-20-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1040-5-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-4-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/1040-3-0x0000000002880000-0x0000000002889000-memory.dmp

Filesize
36KB

Download
memory/2200-69-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-78-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-75-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-76-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-77-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-79-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-80-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-67-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-68-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-70-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-71-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-72-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-74-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2200-73-0x0000000001940000-0x0000000001949000-memory.dmp

Filesize
36KB

Download
memory/2424-56-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/2424-55-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/2588-38-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-35-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-39-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-32-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-33-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-34-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-52-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2588-40-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-36-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-37-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-41-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-42-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-43-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-44-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/2588-48-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2588-45-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads