Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29-07-2024 00:52
General
-
Target
2eea949d5e460e676cfc46fedbfd7228_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2eea949d5e460e676cfc46fedbfd7228
-
SHA1
1aaa16ff737078f33d1d3a1698dba0c06d391505
-
SHA256
0957af4a0171acd92171ed5b6922e5209095058c4d80bb1cb3cc770810c1786d
-
SHA512
0d1df077e17274c752997be07d6337d3548b259af0da041dd48f86e64e08c3db2c32107d78698b25be88953cb2bb83efe044a8ac1f1879393b985b39ff17cba3
-
SSDEEP
24576:/uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:B9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2eea949d5e460e676cfc46fedbfd7228_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\mv2NRI\rdpshell.exeC:\Users\Admin\AppData\Local\mv2NRI\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\Al7vSpX\osk.exeC:\Users\Admin\AppData\Local\Al7vSpX\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\ypK5wM5i\rekeywiz.exeC:\Users\Admin\AppData\Local\ypK5wM5i\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD52cc27f532454289cce45ad8d10354e6d
SHA116411c94b805d2a2b0714dee55ed88117b1724a5
SHA256448408de17a69a143b5571274b4830dfb24e0fbbcd3ea48de9fab62c742f4738
SHA512a011a59855cc5dcfdaa1c47d9c1a31176432f6cb2ac7f742352712ca61cce8ce8bb05b7e31c90e5ee9396282d6fe4c88e16d3a76e4b9919e7e82cc57622c3d5a
-
Filesize
1.2MB
MD547d92ac5a75d2b9c6b5e6d0120d53918
SHA136444cba8c1784a89eed1c682e7dd55de84fba98
SHA2565991621f8cb0c7a811cf03c326e33aceec6517710f49bbfa4226fef1dc32c598
SHA512f73e0540bf733e47a58fd846ff374dd7ebf7f0f2ab94d487d634018ed06c3a6deef16eddf58790f813be99ef94c3d7de55c323a39307f93d92547439726be8be
-
Filesize
1.2MB
MD546d5d62be0a293dedfd78c4043bb9861
SHA1a876f5b9aba4713a9d67ae551ce98c16736572aa
SHA256b6cfbc79864e0f58a24bc0c85a2a0690cb8ec0817f56286ccdc73d6373d0d5ee
SHA51285a5656bd2d0ff89c13bf516f352e006dc04906dadaa10eb45ad2d6e1d48409a857b2d084d22653fc3ee2251978bb2ab9340788b99f7505064045b22dcd399ed
-
Filesize
1KB
MD5a6cf3d51c634c12bb20b4c85eb40d129
SHA1412b9519c97cce114d2c4b32d8b7e0c7feebad6f
SHA256c2d04a8e9210e26a1bfc8b64c67afa101b51faf1af460df059b2c841060fa308
SHA512608adf6363067f77772dc3da09c552918af9d7029c8d0f49a055c48d012592f43c003634df201e6d5fe4a7d8c16145da048ac1a8ca86490c78d782f6e876af66
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
292KB
MD5a62dfcea3a58ba8fcf32f831f018fe3f
SHA175f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b
SHA256f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e
SHA5129a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB