Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 08:45
General
-
Target
11157abacceb621b196ead613c8629f3_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
11157abacceb621b196ead613c8629f3
-
SHA1
5d1e650acd82a4c5f55dfce2f3ed03c94efb1078
-
SHA256
723519dfffc2771cf0f37492379c8d64abc5744b91118f8cac3ea792273fb2b3
-
SHA512
11768525b7e9865cce1ba0d371f19de9ae7111f271b3065a371ea1e9e9581641f1d42df5fc760ed9dd4d08030cd7b4649e4009d0c201b4ed5a4d690df3335485
-
SSDEEP
24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:s9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11157abacceb621b196ead613c8629f3_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\Ie4Nf\dpapimig.exeC:\Users\Admin\AppData\Local\Ie4Nf\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\uVAjJPBO\LicensingUI.exeC:\Users\Admin\AppData\Local\uVAjJPBO\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\pcI\DisplaySwitch.exeC:\Users\Admin\AppData\Local\pcI\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD55d8abc73b926cea2b0b54cb640f7a140
SHA115d61407b3f58fbdf29469bb2bd68ef89097b64e
SHA2567c115a1394d4f7c958fb74f9b5ed27780a59b7b9cfddb1a56e4efd01bfaeccfe
SHA512bbfc5a5d473daa5561ecd2467f74acbbecaee07a9b0a3f272f2d90c7db5eac422c5516f4a2bd92d4711acbcfbe1ea3637013dfafa2953814961e29e878fccece
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
1.2MB
MD502da0e9bf175b1509905c1dbe8aa07df
SHA1aa64b67b6732d52f26dd6f3a32946d800b2d698d
SHA25644a1fe6965a457181e6a2a2856685dd07ef2578f35da49aeace3641ba3b91479
SHA5122aa63ed33c959c9bbd8ad08aec3e9b58a55ad858e6bc6b9b63daed6de2cdb33d3081d324554642d55708b8885c4f1c000216960680836555a2c622d1520f6785
-
Filesize
1.4MB
MD570e6b646374e672a95af5f7c87d2c237
SHA1fb0fb9a5ae755355dfda63cfcf5802c4b745ce8d
SHA256a0fb74ef70d709cd46f76a5478674748282b4a9b84dcd0e9e989ee8b93840fb6
SHA512ba12ae3728f7b701fcb0facea5618f781d16f582bdbec0427ae3e012c7cd5f15abc8088ec80a16691508797a1ba19c7873e7d549f55d3f7de80f5e64656e0698
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
1KB
MD5f24b589796774bd12d134a6ebae1202a
SHA16b92ae9f5f7d3e75db9558954d273e9272686d41
SHA25631967bd9b545207b0087f4d2373dd23d3744cdc2ec4fe9f764947661dcca3efd
SHA512913bfb0e84dda8d1089fdbf4e307e11491b35781a187a44fdc9438d4da254e85d50816080c3963076e4c9b964add4ac20d27f78ae33853b829119ecc0c048bc2
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB