Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
31-07-2024 14:05
General
-
Target
7cb39a958205ae575a11bcfbecd2923b_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7cb39a958205ae575a11bcfbecd2923b
-
SHA1
c098dbee02a9f5b0185a097d2907d05611c06d5d
-
SHA256
c239b07bc04c591ebb22d3ec9be5a81b73b5b36b80b867e49447284c180ad00d
-
SHA512
6897ce3683f63a898fb5859a8641833cc0bf230275f1cf5d8d1741b483ef660ab5ba7c323fecd9c8f28abcf5d606c4098a2e12dc9779c0016bae9eee43e06f34
-
SSDEEP
24576:5uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:r9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7cb39a958205ae575a11bcfbecd2923b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\6mZGyw\BdeUISrv.exeC:\Users\Admin\AppData\Local\6mZGyw\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Narrator.exeC:\Windows\system32\Narrator.exe1⤵
-
C:\Users\Admin\AppData\Local\gTuNQYzr\Narrator.exeC:\Users\Admin\AppData\Local\gTuNQYzr\Narrator.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\b5Acxn\ie4uinit.exeC:\Users\Admin\AppData\Local\b5Acxn\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\i0k\CloudNotifications.exeC:\Users\Admin\AppData\Local\i0k\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
1.2MB
MD52c7feb994d0f788cf687e6f3982c204f
SHA1247c688f18203d200a8bf14a73ff6af64c27fc37
SHA25610bdf5d7bcb8e0b9c6f45039c4ffd6823db432b8f4a98e7b8e29ef8d80b998c6
SHA51209aa4532409959fbc5891b407d172f3de6f1948adf64c66cbfcebc40914d9cf4033a80c681a88d8a5edccb13c5618ef2e17b48f521d50433091c78723bd9f58a
-
Filesize
1.2MB
MD598f74ffe892fced3bcfa1a1d645164a9
SHA1aa2f43fa6dfd7186b44f71ada3cee1cce0284cf5
SHA2562ad01bf4d9f8f2c1beb68cc7c6629174872c12f54de57bb4d5a1f93106713ea6
SHA5127a331b8055437ba4a65f416b8a2ca144b09b3ef3a680bdad94276d875d9a85b7aebf4fab38801a686369231deab8f394b1e11d996b6b16862a4ae1a21c0bcfab
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
521KB
MD5d92defaa4d346278480d2780325d8d18
SHA16494d55b2e5064ffe8add579edfcd13c3e69fffe
SHA25669b8c93d9b262b36e2bdc223cc0d6e312cc471b49d7cc36befbba1f863a05d83
SHA512b82c0fbc07361e4ad6e4ab171e55e1e41e9312ba995dce90696ca90f734f5d1ea11371ca046e8680ea566a1c2e0643ab86f1f6dcf6cbd05aed8448425a2830b5
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
1.2MB
MD56176ad0422b098c49aa58c0598dff0a2
SHA1876b8a8123a7244f159e6d5276e93fefcb101b1b
SHA256a129036b6d7b7df2cb80ce01a8cb266f6c0e87b6ffd067f935f9f4de5e78c688
SHA5125c15a77218254ff8c9fa2da83e7034700137b171d15407cd7fab7b128b5d45d161a8250b50c58c37f6b5a8117a3ac4f13dac8e8bfdcac24ff156e03dba4ca8e2
-
Filesize
1KB
MD5dfa1b84904951238514543cf8f17ac80
SHA1c05a6df0aa8db12fc4250ae8302fa8dd0de00015
SHA2562d95ecbfe08dcc4724e0fa27ff8ff84e1cbb66babc18d42f999f107345b034b0
SHA5120890805cb946ad1979f5842f0114754c28fb967a53050b2e212f6167b993a00c8d4db054733bb1126ff1f2ec1065dea7ce912257d9b00e4bbfdbab9f117d4be5
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB