Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 04:56
General
-
Target
09e345e03852dce614f9eca73b61b1a1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
09e345e03852dce614f9eca73b61b1a1
-
SHA1
2aa0419cefd28af7e97a89d912ba3c4375897881
-
SHA256
394fcd54556c7c74118515fe23a2b666ea648ad9ee152a82fa8eefa200ccf4a6
-
SHA512
65b8f72e0d80f61882a384d50d4ce7698c5a04d39986449c6b064bbd06baa68a370211a1ca1c2aff235c8597cfbcd9a6b6b011e7833806d48616e30b3a7d1ecc
-
SSDEEP
24576:LuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:V9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09e345e03852dce614f9eca73b61b1a1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\P5IO9\Utilman.exeC:\Users\Admin\AppData\Local\P5IO9\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\4jWT\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\4jWT\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\K23v\consent.exeC:\Users\Admin\AppData\Local\K23v\consent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\l0u3m0xFU\sdclt.exeC:\Users\Admin\AppData\Local\l0u3m0xFU\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5591a98c65f624c52882c2b238d6cd4c4
SHA1c960d08c19d777069cf265dcc281807fbd8502d7
SHA2565e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA5121999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074
-
Filesize
1.2MB
MD57f674b1a8d325e2376d7ef833bea2a27
SHA13c065915a4f28ef155dbb25ac46faaa5efd0e698
SHA256bc96897f8dd8729e13bb650878c215a35ea6fc09609749b7241390cc3d73cf1f
SHA5120fa201937dee38b1956d46ce2b29b7108edc88a392e6534d22405f91ef9210bebf2f26835077c34a71c8a37aafc23499f66354936a0d618ef2d1a016e82b7d83
-
Filesize
162KB
MD56646631ce4ad7128762352da81f3b030
SHA11095bd4b63360fc2968d75622aa745e5523428ab
SHA25656b2d516376328129132b815e22379ae8e7176825f059c9374a33cc844482e64
SHA5121c00ed5d8568f6ebd119524b61573cfe71ca828bd8fbdd150158ec8b5db65fa066908d120d201fce6222707bcb78e0c1151b82fdc1dccf3ada867cb810feb6da
-
Filesize
1.4MB
MD538ff8d26142827a1a3dcad18ea46c82e
SHA1946c757cd8c370506ac8624e2e6fc239666e4c16
SHA2561a6a9fc9e4216eb43453512ea07251e259ea5a2ea768be398b2a6304f7d439bc
SHA51231cbd6fb86f7ea6cdd0d7d89850b34146b9dc86caa97185ba1c81e6607424cf6be81e2b5654cfdddd8ec49760e1d01a6a62cc72112ad8a56cc8ba1b8f213e3ab
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
1.2MB
MD5e09d48f225e7abcab14ebd3b8a9668ec
SHA11c5b9322b51c09a407d182df481609f7cb8c425d
SHA256efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3
SHA512384d606b90c4803e5144b4de24edc537cb22dd59336a18a58d229500ed36aec92c8467cae6d3f326647bd044d8074931da553c7809727fb70227e99c257df0b4
-
Filesize
1.2MB
MD5e1be98e43e1b6fcb86b6d75adc8b11e2
SHA14140051f6a74268809795be3d796fcb5f385a6fa
SHA256da2b60db53b8812161cd9cf438469fafa3c9db348dba14d20e5244ea74e7a450
SHA5127128c97d8caed9e6e1b8ec276b17f00db319127b1fb5f0a808e15231f4d2e5f7ed6fd52e9c738af8d5f553a72e373830e03abfb9808d96ea140b676ebdedf013
-
Filesize
1KB
MD55db39f3f73e3ada433c7b22e6ff982b5
SHA12cd5d7782e61982d79df81fb65f61397d5e12709
SHA2569497eb456d50d449b17681c55e5aa613afe9f759d002c6517a9c94f19b4ac324
SHA51285557d3593c89cd754c1d221e8920cfecaa320e1191ddf20a98d7c0b375a78f7aae082b374ad2e6270d5974ee90c72d98c1faa30cf9c7188c3f21712ad86a02b
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB