Analysis
-
max time kernel
135s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f.dll
-
Size
428KB
-
MD5
0ff1c8854048d8538d009fe6bee4f6d3
-
SHA1
455a044bd7562ead8a1a2d45c26eb2a5dcb33086
-
SHA256
73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f
-
SHA512
b6cf07bcc7b236d5fd40d2b790170293ae1654e9b3e12668250fbd18b5ecdd0dbf887a5d9ad6cf2d7fcfbd12155fd38ef2f779f9d66d1109fec8c95670a862c8
-
SSDEEP
12288:OQNFtqgBst6sev1QKI8BjI/Mf6KJ4N6aXf6XOu8O2ozfixQIhqSwLuWr:kgByg9fIyjso2TXfTJHkfDIhqmWr
Malware Config
Extracted
trickbot
100019
soh1
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Trickbot family
-
Program crash 1 IoCs
pid pid_target Process procid_target 1584 532 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1156 wermgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2372 wrote to memory of 532 2372 rundll32.exe 83 PID 2372 wrote to memory of 532 2372 rundll32.exe 83 PID 2372 wrote to memory of 532 2372 rundll32.exe 83 PID 532 wrote to memory of 3628 532 rundll32.exe 85 PID 532 wrote to memory of 3628 532 rundll32.exe 85 PID 532 wrote to memory of 3628 532 rundll32.exe 85 PID 532 wrote to memory of 1156 532 rundll32.exe 86 PID 532 wrote to memory of 1156 532 rundll32.exe 86 PID 532 wrote to memory of 1156 532 rundll32.exe 86 PID 532 wrote to memory of 1156 532 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73c5f8107fec778d208f88bb213136f091be69a5e1d258b7395fd4b3ebc3ba0f.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:3628
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 6323⤵
- Program crash
PID:1584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 532 -ip 5321⤵PID:2712