Malware Analysis Report

2024-10-19 00:59

Sample ID 240827-1xzrkavhqn
Target c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118
SHA256 a95ce1288d1f507831a7c257d2ee148f8fffbe4690e2a8dc8d96ce4886e094a1
Tags
trickbot lib242 banker discovery evasion trojan persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a95ce1288d1f507831a7c257d2ee148f8fffbe4690e2a8dc8d96ce4886e094a1

Threat Level: Known bad

The file c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

trickbot lib242 banker discovery evasion trojan persistence

Trickbot

Trickbot x86 loader

Windows security bypass

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-27 22:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-27 22:02

Reported

2024-08-27 22:04

Platform

win7-20240704-en

Max time kernel

136s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe"

Signatures

Trickbot

trojan banker trickbot

Trickbot x86 loader

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\coplane\ = "0" C:\Windows\system32\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1620 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 1620 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 1620 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 1620 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 1620 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 1620 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 1620 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 1620 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 2408 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 2408 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 2408 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 2408 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 1940 wrote to memory of 660 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 1940 wrote to memory of 660 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 1940 wrote to memory of 660 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 1940 wrote to memory of 660 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 1940 wrote to memory of 660 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 1940 wrote to memory of 660 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 1940 wrote to memory of 660 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 1940 wrote to memory of 660 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 660 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

"C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {71A58F67-9DFD-4626-BB66-29D2C328E022} S-1-5-18:NT AUTHORITY\System:Service:

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

Network

N/A

Files

memory/2408-0-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2408-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2408-10-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2408-9-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2408-4-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2408-2-0x0000000000400000-0x000000000043C000-memory.dmp

\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

MD5 c5d25323ff2485599bc5eb6646ea246e
SHA1 14066b1de7794e035f80aefd96b2a0ec48525e4a
SHA256 a95ce1288d1f507831a7c257d2ee148f8fffbe4690e2a8dc8d96ce4886e094a1
SHA512 71f3c0efb9139b41d21f8d190b1be3791da1e3e3610e15cc4ac193be1afd9200aac9663f9af62f885581d0128accff5c8b53076467f03a12db5cad7d5e8b00a1

memory/2408-16-0x0000000000400000-0x000000000043C000-memory.dmp

memory/660-31-0x0000000010000000-0x0000000010007000-memory.dmp

memory/660-30-0x0000000010000000-0x0000000010007000-memory.dmp

memory/660-29-0x0000000000400000-0x000000000043C000-memory.dmp

memory/660-35-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2152-36-0x0000000000060000-0x0000000000061000-memory.dmp

memory/2152-38-0x0000000140000000-0x0000000140035000-memory.dmp

memory/660-44-0x0000000000400000-0x000000000043C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-27 22:02

Reported

2024-08-27 22:05

Platform

win10v2004-20240802-en

Max time kernel

134s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe"

Signatures

Trickbot

trojan banker trickbot

Trickbot x86 loader

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe = "C:\\Users\\Admin\\AppData\\Roaming\\coplane\\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe" C:\Windows\system32\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A myexternalip.com N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3844 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 3844 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 3844 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 3844 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 3844 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 3844 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 3844 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe
PID 4068 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 4068 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 4068 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 3480 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 3480 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 3480 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 3480 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 3480 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 3480 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 3480 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe
PID 4940 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c5d25323ff2485599bc5eb6646ea246e_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3844 -ip 3844

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 260

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

"C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3480 -ip 3480

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 268

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 myexternalip.com udp
US 34.160.111.145:80 myexternalip.com tcp
CY 93.109.242.134:443 tcp
US 8.8.8.8:53 145.111.160.34.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
CY 93.109.242.134:443 tcp

Files

memory/4068-0-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4068-1-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Roaming\coplane\c6d26323ff2496699bc6eb7747ea247e_KaffaDaket119.exe

MD5 c5d25323ff2485599bc5eb6646ea246e
SHA1 14066b1de7794e035f80aefd96b2a0ec48525e4a
SHA256 a95ce1288d1f507831a7c257d2ee148f8fffbe4690e2a8dc8d96ce4886e094a1
SHA512 71f3c0efb9139b41d21f8d190b1be3791da1e3e3610e15cc4ac193be1afd9200aac9663f9af62f885581d0128accff5c8b53076467f03a12db5cad7d5e8b00a1

memory/4068-6-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4940-10-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4940-12-0x0000000010000000-0x0000000010007000-memory.dmp

memory/3060-18-0x00000288568F0000-0x00000288568F1000-memory.dmp

memory/4940-17-0x0000000000400000-0x000000000043C000-memory.dmp

memory/3060-16-0x0000000140000000-0x0000000140035000-memory.dmp

memory/4940-11-0x0000000010000000-0x0000000010007000-memory.dmp

memory/3060-20-0x0000000140000000-0x0000000140035000-memory.dmp

memory/4940-25-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4940-27-0x0000000002460000-0x000000000251E000-memory.dmp

memory/4940-28-0x0000000002520000-0x00000000027E9000-memory.dmp

memory/3060-35-0x0000000140000000-0x0000000140035000-memory.dmp