Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 02:03
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_133ce95c4551e828deac0907ba57486b71981b6d67eccadf4e7978b794e6eaed.dll
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_133ce95c4551e828deac0907ba57486b71981b6d67eccadf4e7978b794e6eaed.dll
-
Size
1.7MB
-
MD5
ef6df949889c86cdabe1b3c881575073
-
SHA1
831cd748ba4b4daa7188b8e8d58b5df2ce18e222
-
SHA256
133ce95c4551e828deac0907ba57486b71981b6d67eccadf4e7978b794e6eaed
-
SHA512
fcf0f02d97ea898c461322efc4b9ee411ff0a8e44a1e391a7bf5daaa270f383565afcb8f07d46af785d069d34b83778d6d9ac9f599844dd6ee08f2da7fbdf439
-
SSDEEP
1536:XmeVN7p5lgOPKuppLW8JCeaW8x1dGYkmemN0XAgmjei+vA2gcVPQqcU0:XPNLlRCUqW8xUmN0XAg1iZ2rQqcU
Malware Config
Extracted
trickbot
100021
rob142
181.129.85.98:443
189.112.119.205:443
189.51.118.78:443
186.121.214.106:443
49.176.188.184:443
61.69.102.170:443
213.32.252.221:443
89.46.216.2:443
103.36.79.3:443
103.108.97.51:443
95.140.217.242:443
41.175.22.226:443
190.109.169.161:443
186.159.12.18:443
190.109.171.17:443
181.196.148.202:443
186.47.75.58:443
186.42.212.30:443
190.214.21.14:443
187.108.32.133:443
201.184.226.74:443
186.159.5.177:443
- autorun
Signatures
-
Trickbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2780 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2596 wrote to memory of 1460 2596 rundll32.exe 30 PID 2596 wrote to memory of 1460 2596 rundll32.exe 30 PID 2596 wrote to memory of 1460 2596 rundll32.exe 30 PID 2596 wrote to memory of 1460 2596 rundll32.exe 30 PID 2596 wrote to memory of 1460 2596 rundll32.exe 30 PID 2596 wrote to memory of 1460 2596 rundll32.exe 30 PID 2596 wrote to memory of 1460 2596 rundll32.exe 30 PID 1460 wrote to memory of 2488 1460 rundll32.exe 31 PID 1460 wrote to memory of 2488 1460 rundll32.exe 31 PID 1460 wrote to memory of 2488 1460 rundll32.exe 31 PID 1460 wrote to memory of 2488 1460 rundll32.exe 31 PID 1460 wrote to memory of 2780 1460 rundll32.exe 32 PID 1460 wrote to memory of 2780 1460 rundll32.exe 32 PID 1460 wrote to memory of 2780 1460 rundll32.exe 32 PID 1460 wrote to memory of 2780 1460 rundll32.exe 32 PID 1460 wrote to memory of 2780 1460 rundll32.exe 32 PID 1460 wrote to memory of 2780 1460 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_133ce95c4551e828deac0907ba57486b71981b6d67eccadf4e7978b794e6eaed.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_133ce95c4551e828deac0907ba57486b71981b6d67eccadf4e7978b794e6eaed.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2488
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-