Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 15:40
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_801e161c4966767c8fb9c027d91e3a287571ed8c4cf0af4f99bd9c54ec75c326.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_801e161c4966767c8fb9c027d91e3a287571ed8c4cf0af4f99bd9c54ec75c326.dll
-
Size
2.0MB
-
MD5
15a42796e28d7f3f55b1e964c6d1e3ff
-
SHA1
e53ea5af5fcaa2d87383003958cfc6f0c7ed9d20
-
SHA256
801e161c4966767c8fb9c027d91e3a287571ed8c4cf0af4f99bd9c54ec75c326
-
SHA512
9f2628c9d712b9f5638b92c4a0ca76d62bea32af9f14e85de8988bec35353903b142f3c2628a8b49b825c4640480b10cdef0de45bbe9948ab1e1d050ab8d84ea
-
SSDEEP
6144:qpXjcPUqviYVZFiKXJxDPbOoJcfgQwJ2vkeDkCSHVmrOISZKByfjYoxj:qpXjcPl7FzHebpID
Malware Config
Extracted
trickbot
100021
rob142
181.129.85.98:443
189.112.119.205:443
189.51.118.78:443
186.121.214.106:443
49.176.188.184:443
61.69.102.170:443
213.32.252.221:443
89.46.216.2:443
103.36.79.3:443
103.108.97.51:443
95.140.217.242:443
41.175.22.226:443
190.109.169.161:443
186.159.12.18:443
190.109.171.17:443
181.196.148.202:443
186.47.75.58:443
186.42.212.30:443
190.214.21.14:443
187.108.32.133:443
201.184.226.74:443
186.159.5.177:443
- autorun
Signatures
-
Trickbot family
-
Program crash 1 IoCs
pid pid_target Process procid_target 3944 4484 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5028 wermgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1816 wrote to memory of 4484 1816 rundll32.exe 82 PID 1816 wrote to memory of 4484 1816 rundll32.exe 82 PID 1816 wrote to memory of 4484 1816 rundll32.exe 82 PID 4484 wrote to memory of 2724 4484 rundll32.exe 83 PID 4484 wrote to memory of 2724 4484 rundll32.exe 83 PID 4484 wrote to memory of 2724 4484 rundll32.exe 83 PID 4484 wrote to memory of 5028 4484 rundll32.exe 84 PID 4484 wrote to memory of 5028 4484 rundll32.exe 84 PID 4484 wrote to memory of 5028 4484 rundll32.exe 84 PID 4484 wrote to memory of 5028 4484 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_801e161c4966767c8fb9c027d91e3a287571ed8c4cf0af4f99bd9c54ec75c326.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_801e161c4966767c8fb9c027d91e3a287571ed8c4cf0af4f99bd9c54ec75c326.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2724
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 6403⤵
- Program crash
PID:3944
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4484 -ip 44841⤵PID:2940