Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2024, 16:10

General

  • Target

    b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe

  • Size

    580KB

  • MD5

    b25f6c3a4462cb9064ccb93cbe86bf65

  • SHA1

    b1e4b3e01a6ceb4c64c86b9efeb886956338a285

  • SHA256

    8b0434d0a5f7e099621e2fc4fb26120cca8851853dd6c4dc06b054d14ccc91bc

  • SHA512

    5eb594d73ba7aac21499072e0072dfb25f0107eff92b484392dfdc8d3b3edafcbab72ade2d56156940097b1e86c923248e7262654abb86459289ab0098d4a28f

  • SSDEEP

    12288:N0S3WwroioAwIGCnlDVBCRoAwIGCnlDVBCgoAwIGCnlDVBCcoAwIGCnlDVBC/j9b:Owrowj9NrQgE76OzStl

Malware Config

Extracted

Family

trickbot

Version

1000303

Botnet

lib356

C2

85.143.220.111:443

24.247.181.155:449

174.105.235.178:449

92.223.105.204:443

181.113.17.230:449

174.105.233.82:449

71.14.129.8:449

216.183.62.43:449

42.115.91.177:443

185.251.39.94:443

71.94.101.25:443

206.130.141.255:449

185.251.39.47:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

24.119.69.70:449

46.173.218.246:443

103.110.91.118:449

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot family
  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe
      C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Adds Run key to start application
        PID:3644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe

    Filesize

    580KB

    MD5

    b25f6c3a4462cb9064ccb93cbe86bf65

    SHA1

    b1e4b3e01a6ceb4c64c86b9efeb886956338a285

    SHA256

    8b0434d0a5f7e099621e2fc4fb26120cca8851853dd6c4dc06b054d14ccc91bc

    SHA512

    5eb594d73ba7aac21499072e0072dfb25f0107eff92b484392dfdc8d3b3edafcbab72ade2d56156940097b1e86c923248e7262654abb86459289ab0098d4a28f

  • memory/3208-9-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-7-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-20-0x000000000044B000-0x000000000044C000-memory.dmp

    Filesize

    4KB

  • memory/3208-15-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-14-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-13-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-12-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-11-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-10-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-6-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-21-0x0000000000400000-0x0000000000493000-memory.dmp

    Filesize

    588KB

  • memory/3208-8-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-18-0x0000000002B10000-0x0000000002B50000-memory.dmp

    Filesize

    256KB

  • memory/3208-5-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-4-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-3-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-16-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3208-17-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/3644-67-0x0000000140000000-0x0000000140039000-memory.dmp

    Filesize

    228KB

  • memory/3644-52-0x0000000140000000-0x0000000140039000-memory.dmp

    Filesize

    228KB

  • memory/3644-53-0x00000223BC130000-0x00000223BC131000-memory.dmp

    Filesize

    4KB

  • memory/3644-54-0x0000000140000000-0x0000000140039000-memory.dmp

    Filesize

    228KB

  • memory/5072-38-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-43-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-48-0x0000000010000000-0x0000000010007000-memory.dmp

    Filesize

    28KB

  • memory/5072-47-0x0000000010000000-0x0000000010007000-memory.dmp

    Filesize

    28KB

  • memory/5072-35-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-36-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-37-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-46-0x0000000000400000-0x0000000000493000-memory.dmp

    Filesize

    588KB

  • memory/5072-42-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-41-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-40-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-39-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-33-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-32-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-31-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-30-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/5072-60-0x0000000002D50000-0x0000000002E0E000-memory.dmp

    Filesize

    760KB

  • memory/5072-61-0x0000000002E10000-0x00000000030D9000-memory.dmp

    Filesize

    2.8MB

  • memory/5072-34-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB