Analysis Overview
SHA256
10001f3da1757be0861df508d85434fbf6c6c422ad9e388d8e37cc7861a0bbea
Threat Level: Known bad
The file c5c6865deadd8801977c7e46d28ce000_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Trickbot
Stops running service(s)
Executes dropped EXE
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Looks up external IP address via web service
Adds Run key to start application
Drops file in System32 directory
Launches sc.exe
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-27 21:28
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-27 21:28
Reported
2024-08-27 21:31
Platform
win10v2004-20240802-en
Max time kernel
143s
Max time network
147s
Command Line
Signatures
Trickbot
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMY\\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe" | C:\Windows\system32\svchost.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipecho.net | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe"
C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ipecho.net | udp |
| US | 34.160.111.145:80 | ipecho.net | tcp |
| CR | 170.81.32.66:449 | tcp | |
| US | 8.8.8.8:53 | 145.111.160.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.142.123.92.in-addr.arpa | udp |
| CR | 170.81.32.66:449 | tcp | |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| CR | 170.81.32.66:449 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| PL | 31.179.162.86:443 | tcp |
Files
memory/3156-0-0x0000000000401000-0x0000000000417000-memory.dmp
memory/3156-1-0x0000000000400000-0x0000000000484000-memory.dmp
memory/3156-3-0x0000000000400000-0x0000000000484000-memory.dmp
C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
| MD5 | c5c6865deadd8801977c7e46d28ce000 |
| SHA1 | 8b1f99bfa477d5f9fd3400565bf07e787fe0f56f |
| SHA256 | 10001f3da1757be0861df508d85434fbf6c6c422ad9e388d8e37cc7861a0bbea |
| SHA512 | 51956613da7bb0f8a08f77476138e7f4f8f22ff5cccc50b918e3d2b55adfa05a01b22b4e3388de2fcdd3b8f3fd7cc0f568295610fbd6a9f8c61125f7223ab068 |
memory/4844-8-0x0000000000400000-0x0000000000484000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2392887640-1187051047-2909758433-1000\0f5007522459c86e95ffcc62f32308f1_c186ecc3-67e4-4d2b-8682-b6c322da87aa
| MD5 | dd77a5c4695decf00232093fc8bd1be0 |
| SHA1 | 6e3ddbc3a5892c9d3ed168478dce6fc89931f702 |
| SHA256 | 078addcffe118ebc7bd58495512da8aea78cbe6b8604d565616926d886354521 |
| SHA512 | 891f3a6643d26e102e3b85c61a8e4da55081987ed456aa6edcbddc34304921c7c62b4dd9e122dbfc04edc502b3f0acd274aff092624df19cce5281e977bdd880 |
memory/4844-11-0x0000000000400000-0x0000000000484000-memory.dmp
memory/4844-12-0x0000000010000000-0x0000000010007000-memory.dmp
memory/3812-17-0x0000000140000000-0x0000000140035000-memory.dmp
memory/3812-18-0x0000022E78D90000-0x0000022E78D91000-memory.dmp
memory/3812-19-0x0000000140000000-0x0000000140035000-memory.dmp
memory/3156-26-0x0000000000401000-0x0000000000417000-memory.dmp
memory/3156-25-0x0000000000400000-0x0000000000484000-memory.dmp
memory/4844-27-0x0000000000400000-0x0000000000484000-memory.dmp
memory/4844-28-0x00000000027D0000-0x000000000288E000-memory.dmp
memory/4844-29-0x0000000002890000-0x0000000002B59000-memory.dmp
memory/3812-36-0x0000000140000000-0x0000000140035000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-27 21:28
Reported
2024-08-27 21:31
Platform
win7-20240704-en
Max time kernel
120s
Max time network
122s
Command Line
Signatures
Trickbot
Stops running service(s)
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | icanhazip.com | N/A | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe"
C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
C:\Windows\system32\taskeng.exe
taskeng.exe {0503FCEF-782F-4688-B608-F8BD2FD5C0AA} S-1-5-18:NT AUTHORITY\System:Service:
C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | icanhazip.com | udp |
| US | 104.16.185.241:80 | icanhazip.com | tcp |
Files
memory/1880-1-0x0000000000400000-0x0000000000484000-memory.dmp
memory/1880-0-0x0000000000401000-0x0000000000417000-memory.dmp
memory/1880-4-0x0000000000400000-0x0000000000484000-memory.dmp
\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
| MD5 | c5c6865deadd8801977c7e46d28ce000 |
| SHA1 | 8b1f99bfa477d5f9fd3400565bf07e787fe0f56f |
| SHA256 | 10001f3da1757be0861df508d85434fbf6c6c422ad9e388d8e37cc7861a0bbea |
| SHA512 | 51956613da7bb0f8a08f77476138e7f4f8f22ff5cccc50b918e3d2b55adfa05a01b22b4e3388de2fcdd3b8f3fd7cc0f568295610fbd6a9f8c61125f7223ab068 |
memory/1956-12-0x0000000000400000-0x0000000000484000-memory.dmp
memory/2932-21-0x0000000140000000-0x0000000140035000-memory.dmp
memory/2932-22-0x0000000000060000-0x0000000000061000-memory.dmp
memory/2932-23-0x0000000140000000-0x0000000140035000-memory.dmp
memory/1956-17-0x0000000010000000-0x0000000010007000-memory.dmp
memory/1956-16-0x0000000010000000-0x0000000010007000-memory.dmp
memory/1956-15-0x0000000000400000-0x0000000000484000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3450744190-3404161390-554719085-1000\0f5007522459c86e95ffcc62f32308f1_35dd7637-4d7c-4a57-bd86-689f7bd65008
| MD5 | bf746ef5f2cb34daa44bdf9e234d2ec0 |
| SHA1 | 9c2d3123f649e3609523901974d9a741ea6fe5c7 |
| SHA256 | 116f61f117248d59ced8718c8d8251d9a9d943c9e31b106b4e65c833a21d160c |
| SHA512 | 2a246b35156d46ebd5fce2ec7b767589a75c6123bbad97cd6ffbff4bb1022e4c8cc09efe58d6b292ed39d46ec71453c19db269e64f06d06acfa9f4283af11634 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 49ffb9e923af3119b3d2f4b3f200864e |
| SHA1 | 8b591113d649eebcc4905fa27ab1d75d39a06f6a |
| SHA256 | 3fe676d7a85e973802ab00cd97a57c2877bd837e1822deef74490e901b1f8b2e |
| SHA512 | a0a5663b9a743630c8eb93114e6ae471195c1902e8fa8e0255df11b63d817a1b6029f68afab66ca19bc9a0bf6152d053894b2435881995b6dd2409278b3b0c27 |
memory/1880-37-0x0000000000400000-0x0000000000484000-memory.dmp
memory/1956-39-0x0000000000400000-0x0000000000484000-memory.dmp
memory/1988-54-0x0000000000400000-0x0000000000484000-memory.dmp