Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12-05-2024 19:00
General
-
Target
3b9d1bdab0acedf72eb1b7f997bb847f_JaffaCakes118.exe
-
Size
448KB
-
MD5
3b9d1bdab0acedf72eb1b7f997bb847f
-
SHA1
2463213380faaad29d9edc618b065cd176252028
-
SHA256
728e36feef787a220ec0e59acbcfbdb43314efb610048dfba22012ac5feed838
-
SHA512
4829189919bd788df98a0608a3e2511318fc125304bfad74ec406e2a42410a6c8a5df8842887c11f0e8fc70e52dc2b528b1ace473294574d9bab8f58a5f6a3ec
-
SSDEEP
12288:QboBb/W9ANGBAFb5i0P6HfewKQLYg0yCxE:4xBAiAHwfzJ
Score
10/10
Malware Config
Signatures
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Dave packer 2 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b9d1bdab0acedf72eb1b7f997bb847f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b9d1bdab0acedf72eb1b7f997bb847f_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2828-7-0x00000000027C0000-0x00000000027EF000-memory.dmpFilesize
188KB
-
memory/2828-3-0x0000000002300000-0x0000000002332000-memory.dmpFilesize
200KB
-
memory/2828-11-0x00000000027C0000-0x00000000027EF000-memory.dmpFilesize
188KB
-
memory/2828-10-0x0000000002340000-0x000000000236E000-memory.dmpFilesize
184KB
-
memory/2828-9-0x00000000022D0000-0x0000000002300000-memory.dmpFilesize
192KB