Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
18-05-2024 16:55
General
-
Target
55cd4608275076b63f64de24a4a277bb_JaffaCakes118.exe
-
Size
448KB
-
MD5
55cd4608275076b63f64de24a4a277bb
-
SHA1
8109f710e6be3d0159d5d87eaf4f91329157e265
-
SHA256
9e1dbd1c64bfbe5babad71b4ec2857792c07341ae3eb9c5f93472b8288d83144
-
SHA512
d616f3541a6fa955c3d2f6fe97fb13d19d65a8ce4c4f0a099a04112ee71cec3419488301c6d7f0c3905bf1704223bb987efc7cf1693e9e765884164b95e3a21a
-
SSDEEP
12288:QboBb/W9ANGBAFb5i0P6HfewKQLYg0yCxM:4xBAiAHwfz5
Score
10/10
Malware Config
Signatures
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Dave packer 2 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55cd4608275076b63f64de24a4a277bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\55cd4608275076b63f64de24a4a277bb_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4200-3-0x0000000002000000-0x0000000002032000-memory.dmpFilesize
200KB
-
memory/4200-7-0x00000000027E0000-0x000000000280F000-memory.dmpFilesize
188KB
-
memory/4200-11-0x00000000027E0000-0x000000000280F000-memory.dmpFilesize
188KB
-
memory/4200-10-0x00000000027B0000-0x00000000027DE000-memory.dmpFilesize
184KB
-
memory/4200-9-0x0000000001FB0000-0x0000000001FE0000-memory.dmpFilesize
192KB