Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 18:20
Static task
static1
Behavioral task
behavioral1
Sample
6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe
-
Size
440KB
-
MD5
6449a562d9dccbad5581c2b48d11d6da
-
SHA1
3d91eefec7df6289dd939d82f4e36ede1632837c
-
SHA256
ca7c45f4d5d98be94f619cd4df0d1f7cdbf383b4c1365071e54ed85fed62c84f
-
SHA512
814da09a89a4366bd317f5432b6157437c38fa8b91851ca48eb57cb0fa495c744a88e6ca58c1119ee839fca546800a8e1076446ccc059da7549d034c69f81ad7
-
SSDEEP
12288:57OiUgox4kPD463hp4F78V1C/tEEgz6i7:pz+Dz3YF7deEgui7
Malware Config
Extracted
trickbot
1000268
tot318
23.92.93.229:443
94.181.47.198:449
75.103.4.186:443
23.94.41.215:443
181.113.17.230:449
212.23.70.149:443
23.94.233.142:443
170.81.32.66:449
42.115.91.177:443
107.173.102.231:443
121.58.242.206:449
167.114.13.91:443
192.252.209.44:443
182.50.64.148:449
187.190.249.230:443
107.175.127.147:443
82.222.40.119:449
198.100.157.163:443
23.226.138.169:443
103.110.91.118:449
173.239.128.74:443
128.201.92.41:449
70.48.101.54:443
103.111.53.126:449
185.66.227.183:443
182.253.20.66:449
71.13.140.89:443
103.10.145.197:449
178.116.83.49:443
46.149.182.112:449
81.17.86.112:443
62.141.94.107:443
115.78.3.170:443
197.232.50.85:443
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
116.212.152.12:449
68.109.83.22:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/3624-18-0x0000000002230000-0x000000000226D000-memory.dmp trickbot_loader32 -
Executes dropped EXE 1 IoCs
Processes:
7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exepid process 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMT\7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMT\\7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe" svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 ip.anysrc.net -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exepid process 3624 6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exedescription pid process target process PID 3624 wrote to memory of 2696 3624 6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe PID 3624 wrote to memory of 2696 3624 6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe PID 3624 wrote to memory of 2696 3624 6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe PID 2696 wrote to memory of 800 2696 7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6449a562d9dccbad5581c2b48d11d6da_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AIMT\7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\AIMT\7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AIMT\7449a672d9dccbad6691c2b49d11d7da_KaffaDaket119.exeFilesize
440KB
MD56449a562d9dccbad5581c2b48d11d6da
SHA13d91eefec7df6289dd939d82f4e36ede1632837c
SHA256ca7c45f4d5d98be94f619cd4df0d1f7cdbf383b4c1365071e54ed85fed62c84f
SHA512814da09a89a4366bd317f5432b6157437c38fa8b91851ca48eb57cb0fa495c744a88e6ca58c1119ee839fca546800a8e1076446ccc059da7549d034c69f81ad7
-
memory/800-68-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/800-59-0x000001D7F57A0000-0x000001D7F57A1000-memory.dmpFilesize
4KB
-
memory/800-52-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/800-53-0x0000000140000000-0x0000000140035000-memory.dmpFilesize
212KB
-
memory/2696-61-0x00000000035B0000-0x0000000003879000-memory.dmpFilesize
2.8MB
-
memory/2696-60-0x00000000034F0000-0x00000000035AE000-memory.dmpFilesize
760KB
-
memory/2696-47-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2696-48-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2696-46-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/3624-15-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-13-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-10-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-9-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-8-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-6-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-5-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-22-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/3624-12-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-11-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-14-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-3-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-16-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-20-0x0000000000408000-0x0000000000409000-memory.dmpFilesize
4KB
-
memory/3624-17-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-4-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/3624-18-0x0000000002230000-0x000000000226D000-memory.dmpFilesize
244KB
-
memory/3624-7-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB