Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 08:23
Static task
static1
Behavioral task
behavioral1
Sample
80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe
-
Size
548KB
-
MD5
80167e487d931aaf9766d50b4298bdbc
-
SHA1
24bc904fa525f1dff86d3e747074037e0013940f
-
SHA256
c126f1ae61f0349e84ceb177885f388eddee37f8cc819d235539388029cd9713
-
SHA512
d15ca1704fe9917ae8aef211334baa01283a52a1b37e8086abf929b3f5bdb518b75e2532d545dc5e865563c3b99b6447ef31a2de87ed52ea85396af6790c25f1
-
SSDEEP
6144:PTurNmZWPFVBAKNtcda1BObGg4WmwDtYnXutCM2k2wSF+gjoI:7MFbFKaLVWHYXsCvKlgUI
Malware Config
Extracted
trickbot
1000315
lib371
104.168.58.38:443
24.247.181.155:449
24.247.182.39:449
107.174.34.202:443
24.247.182.29:449
24.247.182.179:449
198.46.131.164:443
74.132.135.120:449
198.46.160.217:443
71.94.101.25:443
24.247.182.225:449
192.3.52.107:443
74.140.160.33:449
65.31.241.133:449
140.190.54.187:449
24.247.181.226:449
108.160.196.130:449
89.46.222.239:443
24.247.182.174:449
108.174.60.161:443
75.108.123.165:449
72.189.124.41:449
105.27.171.234:449
182.253.20.66:449
172.222.97.179:449
72.241.62.188:449
198.46.198.241:443
199.227.126.250:449
97.87.172.0:449
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
64.128.175.37:449
24.227.222.4:449
-
autorunControl:GetSystemInfoName:systeminfoName:injectDllName:pwgrab
Signatures
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2412-18-0x0000000000560000-0x00000000005A0000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exepid process 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe 2056 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe -
Loads dropped DLL 2 IoCs
Processes:
80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exepid process 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ident.me 3 ident.me -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2772 sc.exe 3056 sc.exe -
Modifies data under HKEY_USERS 42 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exepowershell.exepid process 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 2668 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exedescription pid process Token: SeDebugPrivilege 2668 powershell.exe Token: SeTcbPrivilege 2056 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exepid process 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe 2056 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.execmd.execmd.execmd.exe90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exedescription pid process target process PID 2412 wrote to memory of 1288 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 1288 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 1288 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 1288 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 1384 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 1384 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 1384 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 1384 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 3052 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 3052 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 3052 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 3052 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe cmd.exe PID 2412 wrote to memory of 2656 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe PID 2412 wrote to memory of 2656 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe PID 2412 wrote to memory of 2656 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe PID 2412 wrote to memory of 2656 2412 80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe PID 1288 wrote to memory of 2772 1288 cmd.exe sc.exe PID 1288 wrote to memory of 2772 1288 cmd.exe sc.exe PID 1288 wrote to memory of 2772 1288 cmd.exe sc.exe PID 1288 wrote to memory of 2772 1288 cmd.exe sc.exe PID 1384 wrote to memory of 3056 1384 cmd.exe sc.exe PID 1384 wrote to memory of 3056 1384 cmd.exe sc.exe PID 1384 wrote to memory of 3056 1384 cmd.exe sc.exe PID 1384 wrote to memory of 3056 1384 cmd.exe sc.exe PID 3052 wrote to memory of 2668 3052 cmd.exe powershell.exe PID 3052 wrote to memory of 2668 3052 cmd.exe powershell.exe PID 3052 wrote to memory of 2668 3052 cmd.exe powershell.exe PID 3052 wrote to memory of 2668 3052 cmd.exe powershell.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe PID 2656 wrote to memory of 2984 2656 90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2772
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:3056
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
-
C:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2984
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {0D62824C-BF6B-41D6-A0BA-803E88CE3681} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1508
-
C:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2056 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Modifies data under HKEY_USERS
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
548KB
MD580167e487d931aaf9766d50b4298bdbc
SHA124bc904fa525f1dff86d3e747074037e0013940f
SHA256c126f1ae61f0349e84ceb177885f388eddee37f8cc819d235539388029cd9713
SHA512d15ca1704fe9917ae8aef211334baa01283a52a1b37e8086abf929b3f5bdb518b75e2532d545dc5e865563c3b99b6447ef31a2de87ed52ea85396af6790c25f1