Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 16:22

General

  • Target

    8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118.dll

  • Size

    451KB

  • MD5

    8b141f034205fae56a4bc7e82b830cfc

  • SHA1

    0e4fe98c6c0d20941a59e62b1109c033c639f715

  • SHA256

    d7e3760fcc1324aef1d78035e02566fe575a29fcd0dbe7287a37459a42ffcdbd

  • SHA512

    e206c3e4c600376bfa073674b4818808883d022f352e27b0cbd52abe1b332b50e9d15612b418a9b07e74a4ec01c7c9ea93d59238aab66cb569a5cb63504ca388

  • SSDEEP

    12288:ofO5ZXvRjuyj6GaJTOoiN6WxSC5L/+UzEO:F/XxuZ2dxP3YO

Malware Config

Extracted

Family

trickbot

Version

100011

Botnet

mon54

C2

194.5.249.156:443

142.202.191.164:443

193.8.194.96:443

45.155.173.242:443

108.170.20.75:443

185.163.45.138:443

94.140.114.136:443

134.119.186.202:443

200.52.147.93:443

45.230.244.20:443

186.250.157.116:443

186.137.85.76:443

36.94.62.207:443

182.253.107.34:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Templ.dll packer 2 IoCs

    Detects Templ.dll packer which usually loads Trickbot.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4752
      • C:\Windows\system32\wermgr.exe
        C:\Windows\system32\wermgr.exe
        3⤵
          PID:3436
        • C:\Windows\system32\wermgr.exe
          C:\Windows\system32\wermgr.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3280

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3280-4-0x00000251CE250000-0x00000251CE251000-memory.dmp

      Filesize

      4KB

    • memory/3280-8-0x00000251CDFA0000-0x00000251CDFC7000-memory.dmp

      Filesize

      156KB

    • memory/3280-11-0x00000251CDFA0000-0x00000251CDFC7000-memory.dmp

      Filesize

      156KB

    • memory/4752-0-0x0000000010000000-0x0000000012072000-memory.dmp

      Filesize

      32.4MB

    • memory/4752-1-0x0000000002CB0000-0x0000000004D05000-memory.dmp

      Filesize

      32.3MB

    • memory/4752-2-0x0000000010000000-0x0000000012055000-memory.dmp

      Filesize

      32.3MB

    • memory/4752-3-0x0000000004D60000-0x0000000004DA1000-memory.dmp

      Filesize

      260KB

    • memory/4752-6-0x0000000010000000-0x0000000012072000-memory.dmp

      Filesize

      32.4MB

    • memory/4752-5-0x0000000004D60000-0x0000000004DA1000-memory.dmp

      Filesize

      260KB

    • memory/4752-9-0x0000000004F60000-0x0000000004F61000-memory.dmp

      Filesize

      4KB

    • memory/4752-7-0x0000000004E00000-0x0000000004E03000-memory.dmp

      Filesize

      12KB

    • memory/4752-10-0x0000000002CB0000-0x0000000004D05000-memory.dmp

      Filesize

      32.3MB