Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
31-07-2024 02:52
General
-
Target
7affed3db9fac1f38542c4b0007955cb_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7affed3db9fac1f38542c4b0007955cb
-
SHA1
00442d11a0b9d02d0dc12ce2be3741c22b1af10f
-
SHA256
f91f2e1e7f032db8baf17135c8d11994e26fef7e9984de97f6be5943380565d4
-
SHA512
4a03ed339abeb17f19549c48bdb497ef4079af8b26bf96c58dfb973b22c127306437a4acb66b2087fccf0eed5e08db5ea2af8779e326092a099209cbf30f1db6
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7affed3db9fac1f38542c4b0007955cb_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\KkK\Netplwiz.exeC:\Users\Admin\AppData\Local\KkK\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\YGNl0\Magnify.exeC:\Users\Admin\AppData\Local\YGNl0\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\5nkV\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\5nkV\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD59597e43b7a605f5a489ba2f041c408ea
SHA1c161afc2e41e39b1332679ab9621037ea3ce1e5a
SHA25677bada5e09443f3a15187509077b37a37af738d534ce25eefb52495c6823236b
SHA5129475aa1bdf5aed6ccc6fac7f6afd7c3906a7a3e8b11c8bddddbac2ac4aa254293add88b279e02c2d8e625dbc957f3b6e162d800f7fa19b92d256647ceb73289f
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1.2MB
MD55c888701ec0ba8f5eaf0dd4abaa11078
SHA19f92f3d2de50c90bbe964ed5c03466e7af5df15f
SHA2565e3e40286b1bd7eef0b3af2e32efc0c06801ec3835749d8d516531f23b4424ed
SHA512c3c4ae8d3c9e66d3a669b797abd4356c44254a3f2b76b041068a862e8eff970b5cd4a53399a8af795da12cf4c1193106b7413c136e4afb9a8a9a326fe50dd81b
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
639KB
MD54029890c147e3b4c6f41dfb5f9834d42
SHA110d08b3f6dabe8171ca2dd52e5737e3402951c75
SHA25657137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d
SHA512dbdc60f8692f13c23dbed0b76e9c6758a5b413bd6aaf4e4d0ba74e69c0871eb759da95c3f85a31d972388b545dcf3bb8abbcbedd29a1e7e48c065130b98b893d
-
Filesize
1.2MB
MD541670c30e99295c6174e6430a4c377bb
SHA135feec483ab2e55d56a7344eb1967fb76b98c673
SHA25699529ef1ba2bb553a60c4abd490705d603e06133618b302cd2b5ce6cf662b183
SHA5125aa22eb8606be839b885c763feb5e1a55baa16a94a48ea96bfb39e83cfe8ad4ac0b7be1d4fde5818a21fd40b47e6ee745ea12a626b56c06f290ac4fab6ab12d3
-
Filesize
1KB
MD5b0304bffcbaf75fc112661b7b185a5c6
SHA1b95f0cd60b2c5f6a3eb0496ecbcbd1eb4d9a6fc3
SHA2567cc656a5ac27cf873b5627ba1161de35d8c048a0e78f266f4e60ed597d0b1218
SHA512aaa717749a6d38febe70731485fcc73768299a7d19fc3b6076b6616a33c0d5f44c3b74bcdd88b72bf5ad0bcda7f721e67b3d4ea9482b77319236f3b4b03abd61
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB