Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 12:35
Static task
static1
Behavioral task
behavioral1
Sample
ff4969e21689a0492b239dac2fe54bd1_JaffaCakes118.dll
Resource
win7-20240215-en
General
-
Target
ff4969e21689a0492b239dac2fe54bd1_JaffaCakes118.dll
-
Size
1.9MB
-
MD5
ff4969e21689a0492b239dac2fe54bd1
-
SHA1
c6efa4e33d17189804a2256b4f52505c2d411185
-
SHA256
4a5ef969e3e70f1425be5a3b05cde7838c4248b062eeb5ffee844f9df98c0f7b
-
SHA512
a8e74a5301afd9caac08eb799c89785111e9714e27faacd5d0dda19e3d2881f4a8121ad21e0e3bdfabd41acd24b2dbd3f706e1eed72692b3865147593b66ed62
-
SSDEEP
12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1208-5-0x0000000002F20000-0x0000000002F21000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
rdpinit.exeUtilman.exeMpSigStub.exepid process 2676 rdpinit.exe 3012 Utilman.exe 2824 MpSigStub.exe -
Loads dropped DLL 7 IoCs
Processes:
rdpinit.exeUtilman.exeMpSigStub.exepid process 1208 2676 rdpinit.exe 1208 3012 Utilman.exe 1208 2824 MpSigStub.exe 1208 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aknlhzir = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\DNTException\\Low\\xhPDXc\\Utilman.exe" -
Processes:
rundll32.exerdpinit.exeUtilman.exeMpSigStub.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rdpinit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Utilman.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MpSigStub.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
description pid process target process PID 1208 wrote to memory of 2616 1208 rdpinit.exe PID 1208 wrote to memory of 2616 1208 rdpinit.exe PID 1208 wrote to memory of 2616 1208 rdpinit.exe PID 1208 wrote to memory of 2676 1208 rdpinit.exe PID 1208 wrote to memory of 2676 1208 rdpinit.exe PID 1208 wrote to memory of 2676 1208 rdpinit.exe PID 1208 wrote to memory of 2100 1208 Utilman.exe PID 1208 wrote to memory of 2100 1208 Utilman.exe PID 1208 wrote to memory of 2100 1208 Utilman.exe PID 1208 wrote to memory of 3012 1208 Utilman.exe PID 1208 wrote to memory of 3012 1208 Utilman.exe PID 1208 wrote to memory of 3012 1208 Utilman.exe PID 1208 wrote to memory of 2844 1208 MpSigStub.exe PID 1208 wrote to memory of 2844 1208 MpSigStub.exe PID 1208 wrote to memory of 2844 1208 MpSigStub.exe PID 1208 wrote to memory of 2824 1208 MpSigStub.exe PID 1208 wrote to memory of 2824 1208 MpSigStub.exe PID 1208 wrote to memory of 2824 1208 MpSigStub.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff4969e21689a0492b239dac2fe54bd1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\pEtxVmMAk\rdpinit.exeC:\Users\Admin\AppData\Local\pEtxVmMAk\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\nacIm2llG\Utilman.exeC:\Users\Admin\AppData\Local\nacIm2llG\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MpSigStub.exeC:\Windows\system32\MpSigStub.exe1⤵
-
C:\Users\Admin\AppData\Local\JV1\MpSigStub.exeC:\Users\Admin\AppData\Local\JV1\MpSigStub.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\JV1\VERSION.dllFilesize
1.9MB
MD5cdad1eb199164949c4b60130f9a12bc8
SHA196fa76aaa13f07b860463371d67ed24cff39d1f1
SHA256177454cd9e91cac17a8d28a7f568f2543183aac56d17b56a009f6feab1ff0421
SHA5123760cb07e72f7db3f72a41effcb14df2b46585cb52a6a753c9a11c94de1f01ec973135ffa4c2336268341e9a42944553bb9b841eea9ccd319c105f6d50c7aae1
-
C:\Users\Admin\AppData\Local\pEtxVmMAk\rdpinit.exeFilesize
174KB
MD5664e12e0ea009cc98c2b578ff4983c62
SHA127b302c0108851ac6cc37e56590dd9074b09c3c9
SHA25600bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332
SHA512f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d
-
C:\Users\Admin\AppData\Local\pEtxVmMAk\slc.dllFilesize
1.9MB
MD502f0a7d54b75b962aaccb0d18b712bc0
SHA10821f25ce6e36ee7eb5d4ac9c282379c42259367
SHA25684af17046d65819d2fa34839cc3a6a9c4a12cbfe8ea0f16e5402e5d254c09772
SHA512f10c167d79190cd56fecbe6476851ace5e8be558937f9ee8eb34dd957ff0a77142ff4ac51118e5d57d92e36cf8fe07f569edde875686d6437c141dfd67e7dc8c
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Qscjinkjzo.lnkFilesize
1KB
MD5a28e7e7d7de7ee4a71f701b7c88f7b10
SHA1a444358962e533478b70d464cda3813f4db3d73e
SHA256bd66e40e984360e251c494bdfa9820df37fecc1361812a981ba55469546d7964
SHA512844de6a0b67563a398c97cefbb49f975f251e4629efd982911751f2fd21e515f1d10099cd525b0799acf002828ce09f0a438900fc76946c462546be71bf0bc9e
-
\Users\Admin\AppData\Local\JV1\MpSigStub.exeFilesize
264KB
MD52e6bd16aa62e5e95c7b256b10d637f8f
SHA1350be084477b1fe581af83ca79eb58d4defe260f
SHA256d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA5121f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542
-
\Users\Admin\AppData\Local\nacIm2llG\DUI70.dllFilesize
2.1MB
MD5db9ce426e7ba49916ac637bcc119ceef
SHA138b6b22d1111e4478d6004cf9a3a7c2cb104036e
SHA2565054cd4b1905344beffeffb3d3c47caeb7d3bb7af145c0d04c65d2f653baac82
SHA51206ecafe6c4a7ce8216467ba5836352793a64f88e4b32bd54eaa4a5fc6c9d4cc78411e8ae63f7413efdef75f373a017f6ae67285ae890159043eab2539ff278a7
-
\Users\Admin\AppData\Local\nacIm2llG\Utilman.exeFilesize
1.3MB
MD532c5ee55eadfc071e57851e26ac98477
SHA18f8d0aee344e152424143da49ce2c7badabb8f9d
SHA2567ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975
-
memory/1204-2-0x0000000000190000-0x0000000000197000-memory.dmpFilesize
28KB
-
memory/1204-0-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1204-8-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-33-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-23-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-31-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-34-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-36-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-39-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-40-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-42-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-43-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-47-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-49-0x0000000002F00000-0x0000000002F07000-memory.dmpFilesize
28KB
-
memory/1208-46-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-45-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-55-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-44-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-41-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-38-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-56-0x0000000077821000-0x0000000077822000-memory.dmpFilesize
4KB
-
memory/1208-37-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-35-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-28-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-32-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-30-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-57-0x0000000077980000-0x0000000077982000-memory.dmpFilesize
8KB
-
memory/1208-27-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-26-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-24-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-29-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-21-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-20-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-19-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-16-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-15-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-13-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-11-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-10-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-25-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-7-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-5-0x0000000002F20000-0x0000000002F21000-memory.dmpFilesize
4KB
-
memory/1208-66-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-72-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-75-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-22-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-18-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-145-0x0000000077716000-0x0000000077717000-memory.dmpFilesize
4KB
-
memory/1208-17-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-14-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-4-0x0000000077716000-0x0000000077717000-memory.dmpFilesize
4KB
-
memory/1208-12-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1208-9-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/2676-84-0x0000000000110000-0x0000000000117000-memory.dmpFilesize
28KB
-
memory/2824-123-0x0000000000180000-0x0000000000187000-memory.dmpFilesize
28KB
-
memory/3012-102-0x0000000000100000-0x0000000000107000-memory.dmpFilesize
28KB