Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 14:36
Static task
static1
Behavioral task
behavioral1
Sample
74775e59d00746f145553f4159244c65_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
74775e59d00746f145553f4159244c65_JaffaCakes118.dll
-
Size
344KB
-
MD5
74775e59d00746f145553f4159244c65
-
SHA1
023666efe4c7ac08a8192a67516ae26edc4b2e38
-
SHA256
3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a
-
SHA512
2888de76026161afcf0453d403dfced502d8683a13fbf97337c065a02e539f9943b72c3e528bed112e88f4e6ef3c6ff2a2dc9a91ce5dd30c470e070578dff61f
-
SSDEEP
6144:UEs72CZp1HKqFV+ScJRtHELfWuwDxMuPxE/W3HjD3X1:iRphKqnOJRtHELJwVMuSo/1
Malware Config
Extracted
trickbot
100011
mon55
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
-
autorunName:pwgrab
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1280-0-0x0000000000200000-0x0000000000237000-memory.dmp templ_dll -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 2540 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1792 wrote to memory of 1280 1792 rundll32.exe rundll32.exe PID 1792 wrote to memory of 1280 1792 rundll32.exe rundll32.exe PID 1792 wrote to memory of 1280 1792 rundll32.exe rundll32.exe PID 1792 wrote to memory of 1280 1792 rundll32.exe rundll32.exe PID 1792 wrote to memory of 1280 1792 rundll32.exe rundll32.exe PID 1792 wrote to memory of 1280 1792 rundll32.exe rundll32.exe PID 1792 wrote to memory of 1280 1792 rundll32.exe rundll32.exe PID 1280 wrote to memory of 1276 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 1276 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 1276 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 1276 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 2540 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 2540 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 2540 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 2540 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 2540 1280 rundll32.exe wermgr.exe PID 1280 wrote to memory of 2540 1280 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74775e59d00746f145553f4159244c65_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74775e59d00746f145553f4159244c65_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1280-0-0x0000000000200000-0x0000000000237000-memory.dmpFilesize
220KB
-
memory/1280-1-0x0000000000240000-0x0000000000281000-memory.dmpFilesize
260KB
-
memory/1280-2-0x0000000000240000-0x0000000000281000-memory.dmpFilesize
260KB
-
memory/1280-4-0x0000000010000000-0x0000000010003000-memory.dmpFilesize
12KB
-
memory/1280-3-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1280-7-0x0000000000240000-0x0000000000281000-memory.dmpFilesize
260KB
-
memory/1280-8-0x0000000010000000-0x0000000010003000-memory.dmpFilesize
12KB
-
memory/2540-5-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2540-6-0x00000000000E0000-0x0000000000107000-memory.dmpFilesize
156KB
-
memory/2540-10-0x00000000000E0000-0x0000000000107000-memory.dmpFilesize
156KB