Analysis
-
max time kernel
128s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 08:51
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe
-
Size
624KB
-
MD5
0d31d9367c12034e9d32adaf35ea7b86
-
SHA1
a078beb327160907e1de76a17fed3da04fe7331b
-
SHA256
4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343
-
SHA512
58a65b7c1b41140c664eece2d38583155cc0654047ede3d6125988e803afdf38a3c552c6c8e798e3a6ee8e80b926bc3f6354ec4480ea7328dce2f7391439a7b7
-
SSDEEP
12288:toUm4Qx3c00000000000000000000000000000000000000gDu9THASurT3hBnEp:toHnp/Du9ESUnE4m
Malware Config
Extracted
trickbot
1000513
mor119
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449
-
autorunName:pwgrab
Signatures
-
Trickbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2304 wermgr.exe Token: SeDebugPrivilege 2304 wermgr.exe Token: SeDebugPrivilege 2304 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5072 JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe 5072 JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5072 wrote to memory of 2304 5072 JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe 91 PID 5072 wrote to memory of 2304 5072 JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe 91 PID 5072 wrote to memory of 2304 5072 JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe 91 PID 5072 wrote to memory of 2304 5072 JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fada60435b24124103d6ef63cb6eac6d0c3bfd44ced06675c6201f3b73cd343.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304
-