Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 12:47
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_a700ef8d5462e76067ee158ef5584a34c5f077eda2f6854d86004bee77db1311.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_a700ef8d5462e76067ee158ef5584a34c5f077eda2f6854d86004bee77db1311.dll
-
Size
1.8MB
-
MD5
16301d9d578e62172de61b9daab7d157
-
SHA1
99b3c31bc40b3c7dfaa9ec57a8ea42ccf3aa0542
-
SHA256
a700ef8d5462e76067ee158ef5584a34c5f077eda2f6854d86004bee77db1311
-
SHA512
c2a9dfc86c91ac675561ee8efeaa0c885671bfc0a9a027d08a0aabc766d8a4b70e204f240987aa79fc15ffff9c6906017fc4ffefe30b1010c85ec057f4dc9a6d
-
SSDEEP
1536:0BOA0qKzBmromPgBqLxBqy5ZehAcITbk1fPeWnOCl/JPL48XpHv:0cFqKzBrtwq+ZPTbgmWnBJ4oVv
Malware Config
Extracted
trickbot
100021
rob142
181.129.85.98:443
189.112.119.205:443
189.51.118.78:443
186.121.214.106:443
49.176.188.184:443
61.69.102.170:443
213.32.252.221:443
89.46.216.2:443
103.36.79.3:443
103.108.97.51:443
95.140.217.242:443
41.175.22.226:443
190.109.169.161:443
186.159.12.18:443
190.109.171.17:443
181.196.148.202:443
186.47.75.58:443
186.42.212.30:443
190.214.21.14:443
187.108.32.133:443
201.184.226.74:443
186.159.5.177:443
- autorun
Signatures
-
Trickbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3016 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2532 2744 rundll32.exe 30 PID 2744 wrote to memory of 2532 2744 rundll32.exe 30 PID 2744 wrote to memory of 2532 2744 rundll32.exe 30 PID 2744 wrote to memory of 2532 2744 rundll32.exe 30 PID 2744 wrote to memory of 2532 2744 rundll32.exe 30 PID 2744 wrote to memory of 2532 2744 rundll32.exe 30 PID 2744 wrote to memory of 2532 2744 rundll32.exe 30 PID 2532 wrote to memory of 2216 2532 rundll32.exe 31 PID 2532 wrote to memory of 2216 2532 rundll32.exe 31 PID 2532 wrote to memory of 2216 2532 rundll32.exe 31 PID 2532 wrote to memory of 2216 2532 rundll32.exe 31 PID 2532 wrote to memory of 3016 2532 rundll32.exe 32 PID 2532 wrote to memory of 3016 2532 rundll32.exe 32 PID 2532 wrote to memory of 3016 2532 rundll32.exe 32 PID 2532 wrote to memory of 3016 2532 rundll32.exe 32 PID 2532 wrote to memory of 3016 2532 rundll32.exe 32 PID 2532 wrote to memory of 3016 2532 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a700ef8d5462e76067ee158ef5584a34c5f077eda2f6854d86004bee77db1311.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a700ef8d5462e76067ee158ef5584a34c5f077eda2f6854d86004bee77db1311.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2216
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-