Analysis
-
max time kernel
150s -
max time network
15s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
10-08-2024 23:57
General
-
Target
882f81e1b065d0ee8b1f09e3c0cf5005_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
882f81e1b065d0ee8b1f09e3c0cf5005
-
SHA1
d0edf3240ba31504894f85af5f0a3cb3d3fe1a8a
-
SHA256
a6691293ad0620c03ad88d76e5e032d56eb2101dedef76253168e8555eb37514
-
SHA512
4c89e56f9f8a583601d6f9dd815a4aa7cfbbff4be8cfee2b4ee8f2ff3af0dc9c3ca3bd955ef1aca1d1b979e5aec6e7b1aa3304f1be2eddfe55cd6ba41a5a5a06
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NSt:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\882f81e1b065d0ee8b1f09e3c0cf5005_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\HS3IhbUdl\Utilman.exeC:\Users\Admin\AppData\Local\HS3IhbUdl\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\8g7nwBq\xpsrchvw.exeC:\Users\Admin\AppData\Local\8g7nwBq\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\J0N0f\TpmInit.exeC:\Users\Admin\AppData\Local\J0N0f\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a72dda259db43f2124d25638bb51d3d7
SHA1e6a815d04b254304fc4a585af8b503e439374f9c
SHA256f4600effb003961b6d11d13f6cc94d713934650037c80a699861e18ec2ae2eb4
SHA5129d35a6811f24f3a99312c8c2e647c56ae4d68ee6b30ec76623022fd4ad5e63314bb17ebcfd3005266a602796c359654a3df9bd456e70a40f360fab6b044bc4a0
-
Filesize
1.4MB
MD55e6555fc24a612885b65e05165a994d0
SHA13997e1a888dc9f738f9bc414736f56d00c84cad5
SHA256662fff83c013f7a84a22234145611f8dd41156916faff5875a90c668033fd15e
SHA5120b4b314bcdd9391b3bee6f0839d1e1ea76b80012e3c0120aee051cd6e632f3749e738b74c35851e7dba687a1df0d96371dc61c03b9052542f35fef58ca5da8ed
-
Filesize
1.2MB
MD5f3ee5ba24246135a5529655adcbfb468
SHA154ceaa127eeb54f4f32a577db5fe6eb7e7bf50b6
SHA2563a9c7109ec5a032556a626c6422abfa48025c2a5e181958272d5fdfd2033ce1a
SHA512dc6fba665ab11aa98196919d51962d9d9ece9b13fd239f18d519190d0ade794adbe3bc1ca5b48db08b43412d4e9f423b83fa9ec02bd5aba2ce1aeeebe040059e
-
Filesize
1KB
MD580df3fac82b23a71ef6b39009f0abb86
SHA19bbf13967e61e177bd807d68563ed8016e48ccf4
SHA2565a27883c3c9506f98e318dc7e4f50d09f44409980bb581287b532f7a314e6c79
SHA51265173337b43d85c924101cabfa4d9c3ce1d5a613edeb72c1348363f8d633f6379f771afd0ded913c1cc0c0ad1a1432b68020a39c2f68b11e4cb3d9e34c19131e
-
Filesize
4.6MB
MD5492cb6a624d5dad73ee0294b5db37dd6
SHA1e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA51263bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835
-
Filesize
1.3MB
MD532c5ee55eadfc071e57851e26ac98477
SHA18f8d0aee344e152424143da49ce2c7badabb8f9d
SHA2567ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB