Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 09:17

General

  • Target

    JaffaCakes118_f3a41d33fdf5ec9dbf81b5c511f5b56339ea4719c2e568d586ade0cde72222cd.doc

  • Size

    2.1MB

  • MD5

    578f26bd156782e1c93153e71e31af38

  • SHA1

    6081302fcfb7033b6f5d795fcb623849c8be220f

  • SHA256

    f3a41d33fdf5ec9dbf81b5c511f5b56339ea4719c2e568d586ade0cde72222cd

  • SHA512

    4a301c25841d1a97e7255e104dac4f0d2f930945e9892b1d904483c3564e889730624b8c2006c810e6b7cdf9f7325addba2668a54ad72f27e7500b609af08be5

  • SSDEEP

    24576:mOIFcmtE7voEOJ4wDEeKKeD0qxDRQ85THxfOl1zEEVQW/b06UKQzZ7IPN/ewItlZ:mHIQBJKKULx+9EEhg6uZsUf+Mz

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f3a41d33fdf5ec9dbf81b5c511f5b56339ea4719c2e568d586ade0cde72222cd.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c c:\programdata\HighScores.bat
      2⤵
      • Process spawned unexpected child process
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\trone\altogether4127453.vbs"
        3⤵
          PID:4164
        • C:\Windows\system32\PING.EXE
          ping w 5000 ya.fr
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1720
        • C:\Windows\system32\PING.EXE
          ping w 5000 htr-oi.io
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:920
        • C:\Windows\system32\rundll32.exe
          rundll32 c:\trone\1\ExistingExcel.dll,DllRegisterServer1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3244
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 c:\trone\1\ExistingExcel.dll,DllRegisterServer1
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe
              5⤵
                PID:1740
              • C:\Windows\system32\wermgr.exe
                C:\Windows\system32\wermgr.exe
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1988
          • C:\Windows\system32\PING.EXE
            ping w 5000 htr-oi.io
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:412

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\TCDCB30.tmp\gb.xsl

        Filesize

        262KB

        MD5

        51d32ee5bc7ab811041f799652d26e04

        SHA1

        412193006aa3ef19e0a57e16acf86b830993024a

        SHA256

        6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

        SHA512

        5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

      • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

        Filesize

        16B

        MD5

        d29962abc88624befc0135579ae485ec

        SHA1

        e40a6458296ec6a2427bcb280572d023a9862b31

        SHA256

        a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

        SHA512

        4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

      • C:\trone\altogether4127453.vbs

        Filesize

        815KB

        MD5

        861c3b42993d2b3959d9eacd9f3fa00f

        SHA1

        e834e7429175c7547135a9116102d4b5acfea70c

        SHA256

        267c67704425cfe66e7e48a4c055e241a608795d121d4f5c2b3c56adac18b1ab

        SHA512

        2ceb6d9cc94c874107af90fdcf644140dac042da7adb4a4191929ccaa4200d33731a3c27f3243584e81c4235aca0973103531ad500317424115ecc69c9e8ed98

      • \??\c:\programdata\HighScores.bat

        Filesize

        883KB

        MD5

        1c9b591f02f01abbc553a49b629c5dcb

        SHA1

        d5db0b98de208401eef20abc8022c06c005fe2cb

        SHA256

        8b2f86ef51d4f23dd78cd606b9e4950e02bdc2385d536c3632e61cf8152fa77f

        SHA512

        37b9c430a0bb2dc5affb46c38dc9738e4df3031d1e3e2ac0a5d37dfeb96d65019fc304b40457914a12c45d2b23bf33f65b393368d33432f29604b982e095e070

      • \??\c:\trone\1\ExistingExcel.dll

        Filesize

        483KB

        MD5

        1da055b46fb0698f80a4404b3a3a63b3

        SHA1

        97609b1d447453fa5e431f90668678ac8c090730

        SHA256

        71b4913ef363073f0ecc4b4c5af3ad4b4889ac7f22a3e34d54c9b6572b83c483

        SHA512

        ddebd8487dc0dfd936f65377b7cc072dfc28ecb90943c4fea0e6f0c1ad7563964998d1ba56edce60f64fe076558d43618fb789c2278631f289e6a6cf5a936e23

      • memory/1988-479-0x0000019BB5770000-0x0000019BB5771000-memory.dmp

        Filesize

        4KB

      • memory/2984-564-0x0000000002D10000-0x0000000002D53000-memory.dmp

        Filesize

        268KB

      • memory/2984-451-0x0000000002D10000-0x0000000002D53000-memory.dmp

        Filesize

        268KB

      • memory/3188-12-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-8-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-11-0x00007FFC5A2D0000-0x00007FFC5A2E0000-memory.dmp

        Filesize

        64KB

      • memory/3188-10-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-14-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-17-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-19-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-18-0x00007FFC5A2D0000-0x00007FFC5A2E0000-memory.dmp

        Filesize

        64KB

      • memory/3188-16-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-20-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-15-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-13-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-2-0x00007FFC5CC30000-0x00007FFC5CC40000-memory.dmp

        Filesize

        64KB

      • memory/3188-26-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-30-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-39-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-40-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-7-0x00007FFC5CC30000-0x00007FFC5CC40000-memory.dmp

        Filesize

        64KB

      • memory/3188-9-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-52-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-53-0x00007FFC9CC4D000-0x00007FFC9CC4E000-memory.dmp

        Filesize

        4KB

      • memory/3188-54-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-55-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-56-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-57-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-60-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-64-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-6-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-5-0x00007FFC9CBB0000-0x00007FFC9CDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/3188-1-0x00007FFC9CC4D000-0x00007FFC9CC4E000-memory.dmp

        Filesize

        4KB

      • memory/3188-4-0x00007FFC5CC30000-0x00007FFC5CC40000-memory.dmp

        Filesize

        64KB

      • memory/3188-0-0x00007FFC5CC30000-0x00007FFC5CC40000-memory.dmp

        Filesize

        64KB

      • memory/3188-3-0x00007FFC5CC30000-0x00007FFC5CC40000-memory.dmp

        Filesize

        64KB