Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
12-08-2024 13:12
General
-
Target
8edbc8966c7188e465581d36300c7352_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
8edbc8966c7188e465581d36300c7352
-
SHA1
659416a2b57a6473f69f7ec5d31c8126f4e00ba5
-
SHA256
b85dc997c286d5e1c94c544310837a28f8b7376d5ff40fbf0af80af9cc43cc8f
-
SHA512
fc026ad358a33716ee1bab7f8ebe962c6b2350d3ce6f100c92d35ed69a6d2c6f8a4e95d9b59c1dfa9d00e8513dbd4cfef34df0b045344d8b08ec8820a6fb5d1f
-
SSDEEP
24576:fuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:h9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8edbc8966c7188e465581d36300c7352_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\978\rekeywiz.exeC:\Users\Admin\AppData\Local\978\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\FIi2oK\DisplaySwitch.exeC:\Users\Admin\AppData\Local\FIi2oK\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\vmicsvc.exeC:\Windows\system32\vmicsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\6nmpcZ\vmicsvc.exeC:\Users\Admin\AppData\Local\6nmpcZ\vmicsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD53cf43100d71477a4bfd35cf82a3dcb6a
SHA12d945bd636e6ec810b15af5e5ea81417bbecde1b
SHA2565dd4ad26832984925d8c39d90817a13f6ad4ccfdbd0d0c54aa1dd53db5cf3454
SHA5129edd1e2e3ce166093e4696005f06aeb21022a4b740f8758a91fe255d8ef51b3f24e4cdcefc8c89b046b04ef6f8f7090aa8056f4a6055d189dda6fc8958d94a50
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
1.2MB
MD54ff512e1884ddced70a6e78c86ac220f
SHA1b1ff88a2ec33aaf73fee1c6f63be2e84285019cb
SHA256f580948587b0554bbbb51648f0f5588584309e9467530e6ea97e372cf38c9764
SHA512c278ee92974d546ed051a7dfd6f88fff2aed50d09fba89b60183fa4b3cc358975d8a660b5ac791328fcf8951a89a76a414a990d4e93136874d386a33b880176c
-
Filesize
1KB
MD58f2e67646b9a95244901f861cf41f84b
SHA1a7bc2daf4bcff6902e3a272264df716e5cf9f313
SHA2568600638c71de3db09c3ce1671b8563d95065ebbaaa409baef9ddf4da17bda608
SHA512fb3d51acde324113b081efdb8aa456983912f10d8a2a4709601bbfc4c8e98d66eead659f2fbd8ca69d9887eb116a12bc7ecb72d9dd71a57c30b705ca26ef4602
-
Filesize
238KB
MD579e14b291ca96a02f1eb22bd721deccd
SHA14c8dbff611acd8a92cd2280239f78bebd2a9947e
SHA256d829166db30923406a025bf33d6a0997be0a3df950114d1f34547a9525b749e8
SHA512f3d1fa7732b6b027bbaf22530331d27ede85f92c9fd64f940139fd262bd7468211a8a54c835d3934b1974b3d8ecddefa79ea77901b9ef49ab36069963693f988
-
Filesize
517KB
MD5b795e6138e29a37508285fc31e92bd78
SHA1d0fe0c38c7c61adbb77e58d48b96cd4bf98ecd4a
SHA25601a9733871baa8518092bade3fce62dcca14cdf6fc55b98218253580b38d7659
SHA5128312174a77bab5fef7c4e9efff66c43d3515b02f5766ed1d3b9bd0abb3d7344a9a22cbac228132098428c122293d2b1898b3a2d75f5e4247b1dcb9aa9c7913b1
-
Filesize
1.2MB
MD54f08cc0aa6c25daccad2ff10768d598d
SHA17f44fb0f3303a17ac6b2e62155965f757819348a
SHA256d8e00ac88316b9d0d0a12eaab4721b58f687eb70f644100c258d029f6cb8f293
SHA512fbf082815cee82d46f78370be5afeb35fe0245653dd5a2d281394a4d611f9380f9d9bf48aa4aadbdb9442bc73c18a21559546c3ce783fee36287131dff9286ad
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB