Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29-05-2024 08:23

General

  • Target

    80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe

  • Size

    548KB

  • MD5

    80167e487d931aaf9766d50b4298bdbc

  • SHA1

    24bc904fa525f1dff86d3e747074037e0013940f

  • SHA256

    c126f1ae61f0349e84ceb177885f388eddee37f8cc819d235539388029cd9713

  • SHA512

    d15ca1704fe9917ae8aef211334baa01283a52a1b37e8086abf929b3f5bdb518b75e2532d545dc5e865563c3b99b6447ef31a2de87ed52ea85396af6790c25f1

  • SSDEEP

    6144:PTurNmZWPFVBAKNtcda1BObGg4WmwDtYnXutCM2k2wSF+gjoI:7MFbFKaLVWHYXsCvKlgUI

Malware Config

Extracted

Family

trickbot

Version

1000315

Botnet

lib371

C2

104.168.58.38:443

24.247.181.155:449

24.247.182.39:449

107.174.34.202:443

24.247.182.29:449

24.247.182.179:449

198.46.131.164:443

74.132.135.120:449

198.46.160.217:443

71.94.101.25:443

24.247.182.225:449

192.3.52.107:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

108.160.196.130:449

89.46.222.239:443

24.247.182.174:449

108.174.60.161:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\80167e487d931aaf9766d50b4298bdbc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\cmd.exe
      /c sc stop WinDefend
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\SysWOW64\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        PID:2772
    • C:\Windows\SysWOW64\cmd.exe
      /c sc delete WinDefend
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1384
      • C:\Windows\SysWOW64\sc.exe
        sc delete WinDefend
        3⤵
        • Launches sc.exe
        PID:3056
    • C:\Windows\SysWOW64\cmd.exe
      /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2668
    • C:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe
      C:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2984
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {0D62824C-BF6B-41D6-A0BA-803E88CE3681} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
        PID:1508
        • C:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe
          C:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2056
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe
            3⤵
            • Modifies data under HKEY_USERS
            PID:2588

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\WinDefrag\90178e498d931aaf9877d60b4299bdbc_KaffaDaket119.exe

        Filesize

        548KB

        MD5

        80167e487d931aaf9766d50b4298bdbc

        SHA1

        24bc904fa525f1dff86d3e747074037e0013940f

        SHA256

        c126f1ae61f0349e84ceb177885f388eddee37f8cc819d235539388029cd9713

        SHA512

        d15ca1704fe9917ae8aef211334baa01283a52a1b37e8086abf929b3f5bdb518b75e2532d545dc5e865563c3b99b6447ef31a2de87ed52ea85396af6790c25f1

      • memory/2056-75-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-73-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-78-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-77-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-76-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-67-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-74-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-79-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-72-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-71-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-70-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-69-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-68-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2056-80-0x0000000000620000-0x0000000000629000-memory.dmp

        Filesize

        36KB

      • memory/2412-18-0x0000000000560000-0x00000000005A0000-memory.dmp

        Filesize

        256KB

      • memory/2412-2-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-20-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/2412-10-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-12-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-13-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-14-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-17-0x0000000000424000-0x0000000000425000-memory.dmp

        Filesize

        4KB

      • memory/2412-16-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-9-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-6-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-7-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-15-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-11-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-8-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-5-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-4-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2412-3-0x00000000002B0000-0x00000000002B9000-memory.dmp

        Filesize

        36KB

      • memory/2656-42-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-38-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-32-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-46-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/2656-33-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-34-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-35-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-36-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-37-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-51-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/2656-39-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-40-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-41-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-43-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-44-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2656-45-0x00000000003F0000-0x00000000003F9000-memory.dmp

        Filesize

        36KB

      • memory/2984-55-0x0000000140000000-0x0000000140039000-memory.dmp

        Filesize

        228KB

      • memory/2984-56-0x0000000140000000-0x0000000140039000-memory.dmp

        Filesize

        228KB