Malware Analysis Report

2024-10-19 00:59

Sample ID 240827-1bl9casere
Target c5c6865deadd8801977c7e46d28ce000_JaffaCakes118
SHA256 10001f3da1757be0861df508d85434fbf6c6c422ad9e388d8e37cc7861a0bbea
Tags
trickbot sat77 banker discovery persistence trojan evasion execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

10001f3da1757be0861df508d85434fbf6c6c422ad9e388d8e37cc7861a0bbea

Threat Level: Known bad

The file c5c6865deadd8801977c7e46d28ce000_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

trickbot sat77 banker discovery persistence trojan evasion execution

Trickbot

Stops running service(s)

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Adds Run key to start application

Drops file in System32 directory

Launches sc.exe

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-27 21:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-27 21:28

Reported

2024-08-27 21:31

Platform

win10v2004-20240802-en

Max time kernel

143s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe"

Signatures

Trickbot

trojan banker trickbot

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\AIMY\\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe" C:\Windows\system32\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipecho.net N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3156 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
PID 3156 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
PID 3156 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4844 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe

C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 ipecho.net udp
US 34.160.111.145:80 ipecho.net tcp
CR 170.81.32.66:449 tcp
US 8.8.8.8:53 145.111.160.34.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
CR 170.81.32.66:449 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
CR 170.81.32.66:449 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
PL 31.179.162.86:443 tcp

Files

memory/3156-0-0x0000000000401000-0x0000000000417000-memory.dmp

memory/3156-1-0x0000000000400000-0x0000000000484000-memory.dmp

memory/3156-3-0x0000000000400000-0x0000000000484000-memory.dmp

C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe

MD5 c5c6865deadd8801977c7e46d28ce000
SHA1 8b1f99bfa477d5f9fd3400565bf07e787fe0f56f
SHA256 10001f3da1757be0861df508d85434fbf6c6c422ad9e388d8e37cc7861a0bbea
SHA512 51956613da7bb0f8a08f77476138e7f4f8f22ff5cccc50b918e3d2b55adfa05a01b22b4e3388de2fcdd3b8f3fd7cc0f568295610fbd6a9f8c61125f7223ab068

memory/4844-8-0x0000000000400000-0x0000000000484000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2392887640-1187051047-2909758433-1000\0f5007522459c86e95ffcc62f32308f1_c186ecc3-67e4-4d2b-8682-b6c322da87aa

MD5 dd77a5c4695decf00232093fc8bd1be0
SHA1 6e3ddbc3a5892c9d3ed168478dce6fc89931f702
SHA256 078addcffe118ebc7bd58495512da8aea78cbe6b8604d565616926d886354521
SHA512 891f3a6643d26e102e3b85c61a8e4da55081987ed456aa6edcbddc34304921c7c62b4dd9e122dbfc04edc502b3f0acd274aff092624df19cce5281e977bdd880

memory/4844-11-0x0000000000400000-0x0000000000484000-memory.dmp

memory/4844-12-0x0000000010000000-0x0000000010007000-memory.dmp

memory/3812-17-0x0000000140000000-0x0000000140035000-memory.dmp

memory/3812-18-0x0000022E78D90000-0x0000022E78D91000-memory.dmp

memory/3812-19-0x0000000140000000-0x0000000140035000-memory.dmp

memory/3156-26-0x0000000000401000-0x0000000000417000-memory.dmp

memory/3156-25-0x0000000000400000-0x0000000000484000-memory.dmp

memory/4844-27-0x0000000000400000-0x0000000000484000-memory.dmp

memory/4844-28-0x00000000027D0000-0x000000000288E000-memory.dmp

memory/4844-29-0x0000000002890000-0x0000000002B59000-memory.dmp

memory/3812-36-0x0000000140000000-0x0000000140035000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-27 21:28

Reported

2024-08-27 21:31

Platform

win7-20240704-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe"

Signatures

Trickbot

trojan banker trickbot

Stops running service(s)

evasion execution

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1880 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1880 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
PID 1880 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
PID 1880 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
PID 1880 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe
PID 2920 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2920 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2920 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2920 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1956 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 2440 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2440 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2440 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2440 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1956 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1644 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1644 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1644 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1644 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1956 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 1956 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c5c6865deadd8801977c7e46d28ce000_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

/c sc stop WinDefend

C:\Windows\SysWOW64\cmd.exe

/c sc delete WinDefend

C:\Windows\SysWOW64\cmd.exe

/c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe

C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe

C:\Windows\SysWOW64\sc.exe

sc stop WinDefend

C:\Windows\SysWOW64\cmd.exe

/c sc stop WinDefend

C:\Windows\SysWOW64\cmd.exe

/c sc delete WinDefend

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\sc.exe

sc delete WinDefend

C:\Windows\SysWOW64\cmd.exe

/c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\SysWOW64\sc.exe

sc delete WinDefend

C:\Windows\SysWOW64\sc.exe

sc stop WinDefend

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\taskeng.exe

taskeng.exe {0503FCEF-782F-4688-B608-F8BD2FD5C0AA} S-1-5-18:NT AUTHORITY\System:Service:

C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe

C:\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 icanhazip.com udp
US 104.16.185.241:80 icanhazip.com tcp

Files

memory/1880-1-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1880-0-0x0000000000401000-0x0000000000417000-memory.dmp

memory/1880-4-0x0000000000400000-0x0000000000484000-memory.dmp

\Users\Admin\AppData\Roaming\AIMY\c6c7976deadd9901988c8e47d29ce000_KaffaDaket119.exe

MD5 c5c6865deadd8801977c7e46d28ce000
SHA1 8b1f99bfa477d5f9fd3400565bf07e787fe0f56f
SHA256 10001f3da1757be0861df508d85434fbf6c6c422ad9e388d8e37cc7861a0bbea
SHA512 51956613da7bb0f8a08f77476138e7f4f8f22ff5cccc50b918e3d2b55adfa05a01b22b4e3388de2fcdd3b8f3fd7cc0f568295610fbd6a9f8c61125f7223ab068

memory/1956-12-0x0000000000400000-0x0000000000484000-memory.dmp

memory/2932-21-0x0000000140000000-0x0000000140035000-memory.dmp

memory/2932-22-0x0000000000060000-0x0000000000061000-memory.dmp

memory/2932-23-0x0000000140000000-0x0000000140035000-memory.dmp

memory/1956-17-0x0000000010000000-0x0000000010007000-memory.dmp

memory/1956-16-0x0000000010000000-0x0000000010007000-memory.dmp

memory/1956-15-0x0000000000400000-0x0000000000484000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3450744190-3404161390-554719085-1000\0f5007522459c86e95ffcc62f32308f1_35dd7637-4d7c-4a57-bd86-689f7bd65008

MD5 bf746ef5f2cb34daa44bdf9e234d2ec0
SHA1 9c2d3123f649e3609523901974d9a741ea6fe5c7
SHA256 116f61f117248d59ced8718c8d8251d9a9d943c9e31b106b4e65c833a21d160c
SHA512 2a246b35156d46ebd5fce2ec7b767589a75c6123bbad97cd6ffbff4bb1022e4c8cc09efe58d6b292ed39d46ec71453c19db269e64f06d06acfa9f4283af11634

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 49ffb9e923af3119b3d2f4b3f200864e
SHA1 8b591113d649eebcc4905fa27ab1d75d39a06f6a
SHA256 3fe676d7a85e973802ab00cd97a57c2877bd837e1822deef74490e901b1f8b2e
SHA512 a0a5663b9a743630c8eb93114e6ae471195c1902e8fa8e0255df11b63d817a1b6029f68afab66ca19bc9a0bf6152d053894b2435881995b6dd2409278b3b0c27

memory/1880-37-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1956-39-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1988-54-0x0000000000400000-0x0000000000484000-memory.dmp