Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 22:43
General
-
Target
2876b93cb21d6a2221e6ceb50411d4fd_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2876b93cb21d6a2221e6ceb50411d4fd
-
SHA1
3c10977925549acc722bcfe64e152a1d14d7ebf4
-
SHA256
39703d228241e44be2c2f4034de7002b590f762a909948a58fd48de07f007abb
-
SHA512
9e510ef96855375a0d0584a5031814397e404bc45daaa4c355de332e7675fca77bcbb4ac8263d821d512e114348ebb4bd1c74f2f2891aefbcf9fc4d5e269355d
-
SSDEEP
24576:XuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Na:Z9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2876b93cb21d6a2221e6ceb50411d4fd_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\Qh7P\Utilman.exeC:\Users\Admin\AppData\Local\Qh7P\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\lRds4T0P3\FXSCOVER.exeC:\Users\Admin\AppData\Local\lRds4T0P3\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\Ip53\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\Ip53\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
1.2MB
MD53afe75a11faf3fef760fb1fb2a33e47f
SHA1ea9bac6967157c31fb0ac2d2e0281dbc900f1fc1
SHA2561668a17be625f7a78522400f995588b6e09c62f3b9bade838618898a67167e5e
SHA512900515c94d2e5c54f2aa5b674db2cb22dbb6c1b0953831e47722e8f9f5b66d4e92c18f22ae0d5d694def61ec2fe5d76a2fa9cc3439c62b1054b4938acab2e693
-
Filesize
1.4MB
MD5c4cba81d7a6457c88c01579978b1c02e
SHA15d1e5483998dc8d5b120b6e770d7bd43700b38ed
SHA256fe57016a38f5925f52367464c6a4d8e4eddcbe223033246480296f0414f21d64
SHA51247fe2cc25b3b93146c94585d90515f9aea6e3761052467dca996dc8e3de1fb0db433d060bcbc3d8b83f8cdaa99d4424c5de8abae7eb8c0ced73ab9a0adc58841
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
1.2MB
MD558f448e018560f4e5fa5742e99df0926
SHA1de6aa9fccd17bf3dc73b0b4700a1ff4ddee0275d
SHA2566f39a15b5b2505c7e9cd5fe4334fcbd63f46702276fdcf919c30d70b6726a92b
SHA5124045a3df084dd417745a579a6ec744d61652959aa8de0e933bd548b748d0dafe5ce3513202dfea7b0e4f8b07515dd77adb6b47c1cd627b790802b022d621c6e3
-
Filesize
1KB
MD5dccef57bfe5c1d4404a4120e72104217
SHA1cf41199cd1f0170b2e069bcfbca0c234f6360a9f
SHA2567c8b61c1d81e34a872b1ce9b6a1d897955a4b4933a8e215bd4c3a29b7fd32d32
SHA512fd8aed956580fb49bf39440666e7bf1e85a6fae5860e0a4078ea6f9d85d683906bd0d5cb5c9659bdb32d716748de43668f3489514cb4e8e9ec165003ccd96cf6
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB