Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 18:57
Static task
static1
Behavioral task
behavioral1
Sample
5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe
-
Size
832KB
-
MD5
5d3e393e368f83de2b0d74c435e72017
-
SHA1
2b7ca74573fee0ebab04b23a713067be0d941a1f
-
SHA256
d05d1a32f012408f6d0915a8441d3d0104815dc3b0c28282e11dd7d4530942b0
-
SHA512
71f24670acb0f9a78d8974b6e7e519e9a5301262401498c128541636ffb5e902b4ec6240523d4db765c23cff29308098b807d01d509fd3a1fe16b1b94bbf78a0
-
SSDEEP
6144:0OPzkZx9XfzZbtr08QgkF72BPNC33Fk0oYQzYUqhLKByhgvb4Hf2L:fPzkZfxtQ8Ql75HJp+Yh+v4/8
Malware Config
Extracted
trickbot
2000025
tot44
134.119.186.200:443
45.14.226.115:443
85.204.116.134:443
45.89.127.240:443
195.123.241.195:443
188.34.142.248:443
185.234.72.84:443
108.170.20.72:443
94.158.245.54:443
134.119.186.201:443
45.83.129.224:443
85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443
-
autorunName:pwgrab
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1064 2940 WerFault.exe 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2120 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exepid process 2940 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe 2940 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exedescription pid process target process PID 2940 wrote to memory of 3600 2940 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe cmd.exe PID 2940 wrote to memory of 3600 2940 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe cmd.exe PID 2940 wrote to memory of 2120 2940 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe wermgr.exe PID 2940 wrote to memory of 2120 2940 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe wermgr.exe PID 2940 wrote to memory of 2120 2940 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe wermgr.exe PID 2940 wrote to memory of 2120 2940 5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d3e393e368f83de2b0d74c435e72017_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 6202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2940 -ip 29401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2120-19-0x000001A3F6540000-0x000001A3F6541000-memory.dmpFilesize
4KB
-
memory/2120-21-0x000001A3F63E0000-0x000001A3F6408000-memory.dmpFilesize
160KB
-
memory/2120-20-0x000001A3F63E0000-0x000001A3F6408000-memory.dmpFilesize
160KB
-
memory/2940-11-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-13-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-8-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-9-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-10-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-3-0x0000000000490000-0x0000000000491000-memory.dmpFilesize
4KB
-
memory/2940-12-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-7-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-14-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-15-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-16-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-17-0x00000000031E0000-0x000000000321A000-memory.dmpFilesize
232KB
-
memory/2940-18-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/2940-6-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-5-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/2940-4-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB