Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-09-2024 13:25

General

  • Target

    fe9ecea821f94c0f51c203df9fe8e22b_JaffaCakes118.exe

  • Size

    315KB

  • MD5

    fe9ecea821f94c0f51c203df9fe8e22b

  • SHA1

    37d2f43e3982d280be2679baa0374db4e3f7f219

  • SHA256

    48e4552ed69de24287939835e4333a4d1fc62a78a730940d8df585b3af9815f7

  • SHA512

    93c4237eced462c639309e2986d1752b9602b02e586933dee3706727c36a3ca4213344caa94bf513ff2c34547377f83e9d7c4fa7f4f2b53976ff99e65f03d84e

  • SSDEEP

    6144:z9lMhkm+tkMb4lUhT37mdqRFp1lDkfEqCTS1wj:RZjh7m8flmlP1I

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 6 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe9ecea821f94c0f51c203df9fe8e22b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fe9ecea821f94c0f51c203df9fe8e22b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:2820
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {F63B6589-B94F-4FFD-A99A-AB6E5E69DA0C} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Users\Admin\AppData\Roaming\syshealth\fe9ecea821f94c0f71c203df9fe8e22b_LaffaCameu118.exe
        C:\Users\Admin\AppData\Roaming\syshealth\fe9ecea821f94c0f71c203df9fe8e22b_LaffaCameu118.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\syshealth\fe9ecea821f94c0f71c203df9fe8e22b_LaffaCameu118.exe

      Filesize

      315KB

      MD5

      fe9ecea821f94c0f51c203df9fe8e22b

      SHA1

      37d2f43e3982d280be2679baa0374db4e3f7f219

      SHA256

      48e4552ed69de24287939835e4333a4d1fc62a78a730940d8df585b3af9815f7

      SHA512

      93c4237eced462c639309e2986d1752b9602b02e586933dee3706727c36a3ca4213344caa94bf513ff2c34547377f83e9d7c4fa7f4f2b53976ff99e65f03d84e

    • memory/2720-9-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2720-3-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2720-8-0x0000000010001000-0x0000000010005000-memory.dmp

      Filesize

      16KB

    • memory/2720-7-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2720-1-0x0000000006D80000-0x0000000006E80000-memory.dmp

      Filesize

      1024KB

    • memory/2720-6-0x0000000006D80000-0x0000000006E80000-memory.dmp

      Filesize

      1024KB

    • memory/2720-5-0x0000000000250000-0x000000000027F000-memory.dmp

      Filesize

      188KB

    • memory/2720-13-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2720-2-0x0000000000250000-0x000000000027F000-memory.dmp

      Filesize

      188KB

    • memory/2820-10-0x0000000000060000-0x0000000000080000-memory.dmp

      Filesize

      128KB

    • memory/2820-12-0x0000000000060000-0x0000000000080000-memory.dmp

      Filesize

      128KB

    • memory/3040-17-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB