Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 19:37
Static task
static1
Behavioral task
behavioral1
Sample
6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe
-
Size
504KB
-
MD5
6c0a8a2b30b2e35564f83da09a143cf2
-
SHA1
4ce0c5b010bd56c5dcd2bfc76f98ab64bfb70e54
-
SHA256
d0b9cef00b943a7861cf5bceaadff3ddadb7247e540361543b0279fe3c716e86
-
SHA512
535f6a39275e5114a2c2b9c97e9614da5a8876f605b461fd5ea7454497bb12b9492f8137dbda431202094d0a3fe56330bf407edfc284cba14d2a16dd2f3e4e78
-
SSDEEP
6144:lif3ei2lpZqRzZclaOyugXi2w5O2dw0ddLWCYPvw5izPUaBHjw8QUllWy6berHDT:M/L3rcqEBRaCY3iQPUaNU8DnX6a
Malware Config
Extracted
trickbot
2000010
mor126
195.123.239.59:443
85.143.219.36:443
94.250.254.84:443
94.250.255.217:443
212.80.219.98:443
91.210.171.82:443
45.8.230.108:443
194.156.98.172:443
195.2.93.227:443
62.108.35.179:443
91.200.101.192:443
194.5.249.31:443
195.123.241.157:443
104.161.32.10:443
88.150.197.186:443
62.108.35.204:443
45.155.173.196:443
51.89.177.18:443
194.5.249.107:443
195.123.241.182:443
-
autorunName:pwgrab
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2044 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exepid process 2856 6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe 2856 6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exedescription pid process target process PID 2856 wrote to memory of 2044 2856 6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe wermgr.exe PID 2856 wrote to memory of 2044 2856 6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe wermgr.exe PID 2856 wrote to memory of 2044 2856 6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe wermgr.exe PID 2856 wrote to memory of 2044 2856 6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe wermgr.exe PID 2856 wrote to memory of 2044 2856 6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe wermgr.exe PID 2856 wrote to memory of 2044 2856 6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c0a8a2b30b2e35564f83da09a143cf2_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2044-157-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2044-159-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB
-
memory/2044-158-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB
-
memory/2856-11-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-13-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-8-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-9-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-10-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-3-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-12-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-7-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-14-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-15-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-16-0x0000000000432000-0x0000000000433000-memory.dmpFilesize
4KB
-
memory/2856-17-0x0000000001DE0000-0x0000000001E19000-memory.dmpFilesize
228KB
-
memory/2856-19-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/2856-6-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-5-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2856-4-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB