Analysis Overview
SHA256
def7928d613dfe91e17ca151f14139f8de25914e2c6054f2cc432665a2c9e66a
Threat Level: Known bad
The file JaffaCakes118_def7928d613dfe91e17ca151f14139f8de25914e2c6054f2cc432665a2c9e66a was found to be: Known bad.
Malicious Activity Summary
Trickbot
Trickbot family
Templ.dll packer
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-24 09:38
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-24 09:38
Reported
2024-12-24 09:41
Platform
win7-20241010-en
Max time kernel
130s
Max time network
144s
Command Line
Signatures
Trickbot
Trickbot family
Templ.dll packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\wermgr.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b1eb009e6282801c4ec6a417e9861e5.dll
C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2b1eb009e6282801c4ec6a417e9861e5.dll
C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
Network
| Country | Destination | Domain | Proto |
| MZ | 41.77.134.250:449 | tcp | |
| UA | 192.162.238.186:449 | tcp | |
| HN | 200.52.147.93:443 | tcp | |
| BR | 201.20.118.122:449 | tcp | |
| CA | 142.112.79.223:449 | tcp | |
| PH | 103.225.138.94:449 | tcp | |
| BR | 45.230.244.20:443 | 45.230.244.20 | tcp |
| FR | 95.210.118.90:449 | tcp | |
| BR | 177.85.133.118:449 | tcp |
Files
memory/2576-0-0x0000000000380000-0x00000000003B7000-memory.dmp
memory/2576-1-0x0000000000930000-0x0000000000973000-memory.dmp
memory/2576-2-0x0000000000930000-0x0000000000973000-memory.dmp
memory/2576-3-0x0000000010000000-0x0000000010003000-memory.dmp
memory/2396-4-0x0000000000060000-0x0000000000088000-memory.dmp
memory/2396-5-0x0000000000110000-0x0000000000111000-memory.dmp
memory/2576-6-0x0000000000930000-0x0000000000973000-memory.dmp
memory/2576-7-0x0000000010000000-0x0000000010003000-memory.dmp
memory/2396-8-0x0000000000060000-0x0000000000088000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-24 09:38
Reported
2024-12-24 09:41
Platform
win10v2004-20241007-en
Max time kernel
134s
Max time network
146s
Command Line
Signatures
Trickbot
Trickbot family
Templ.dll packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\wermgr.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4856 wrote to memory of 4688 | N/A | C:\Windows\system32\regsvr32.exe | C:\Windows\SysWOW64\regsvr32.exe |
| PID 4856 wrote to memory of 4688 | N/A | C:\Windows\system32\regsvr32.exe | C:\Windows\SysWOW64\regsvr32.exe |
| PID 4856 wrote to memory of 4688 | N/A | C:\Windows\system32\regsvr32.exe | C:\Windows\SysWOW64\regsvr32.exe |
| PID 4688 wrote to memory of 3340 | N/A | C:\Windows\SysWOW64\regsvr32.exe | C:\Windows\system32\wermgr.exe |
| PID 4688 wrote to memory of 3340 | N/A | C:\Windows\SysWOW64\regsvr32.exe | C:\Windows\system32\wermgr.exe |
| PID 4688 wrote to memory of 1420 | N/A | C:\Windows\SysWOW64\regsvr32.exe | C:\Windows\system32\wermgr.exe |
| PID 4688 wrote to memory of 1420 | N/A | C:\Windows\SysWOW64\regsvr32.exe | C:\Windows\system32\wermgr.exe |
| PID 4688 wrote to memory of 1420 | N/A | C:\Windows\SysWOW64\regsvr32.exe | C:\Windows\system32\wermgr.exe |
| PID 4688 wrote to memory of 1420 | N/A | C:\Windows\SysWOW64\regsvr32.exe | C:\Windows\system32\wermgr.exe |
Processes
C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b1eb009e6282801c4ec6a417e9861e5.dll
C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2b1eb009e6282801c4ec6a417e9861e5.dll
C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| MZ | 41.77.134.250:449 | tcp | |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| UA | 192.162.238.186:449 | tcp | |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| PH | 122.2.28.70:449 | tcp | |
| HN | 200.52.147.93:443 | tcp | |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| DE | 45.155.173.242:443 | tcp | |
| CM | 154.126.176.30:449 | tcp | |
| CA | 142.112.79.223:449 | tcp | |
| BD | 123.200.26.246:449 | tcp | |
| BR | 177.85.133.118:449 | tcp | |
| US | 142.202.191.164:443 | tcp |
Files
memory/4688-0-0x0000000002A50000-0x0000000002A87000-memory.dmp
memory/4688-1-0x0000000002A90000-0x0000000002AD3000-memory.dmp
memory/4688-2-0x0000000002A90000-0x0000000002AD3000-memory.dmp
memory/4688-3-0x00000000012E0000-0x00000000012E1000-memory.dmp
memory/4688-4-0x0000000010000000-0x0000000010003000-memory.dmp
memory/1420-5-0x000001B9036C0000-0x000001B9036C1000-memory.dmp
memory/1420-6-0x000001B9035A0000-0x000001B9035C8000-memory.dmp
memory/4688-7-0x0000000002A90000-0x0000000002AD3000-memory.dmp
memory/4688-8-0x0000000010000000-0x0000000010003000-memory.dmp