Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-08-2024 14:26
General
-
Target
9a653a6ca8bca2e4465c01ec60656a48_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
9a653a6ca8bca2e4465c01ec60656a48
-
SHA1
224dbe5f344ec040c808667827eed50a30c7d8e7
-
SHA256
591c1e2c680af88e04a68e5401b6f40fc86835c6a3753068994822f8af071a06
-
SHA512
512fb0907bb2d248626ceb54371cd57230793748bcec48c4935c12ab47568f2eac4b63f6c702a602b2425b02fcc76584bd8a5980c5660ee47b81223071341b77
-
SSDEEP
24576:ruYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Ncpt:19cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a653a6ca8bca2e4465c01ec60656a48_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\bQsNC\dpapimig.exeC:\Users\Admin\AppData\Local\bQsNC\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\uJBw2l6i\mfpmp.exeC:\Users\Admin\AppData\Local\uJBw2l6i\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\39xcvX\DisplaySwitch.exeC:\Users\Admin\AppData\Local\39xcvX\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
1.2MB
MD56dfe344c04ad5649016d1a944cb3349f
SHA148421ea5c476ebf0b90d5923e39ba031fd9432c4
SHA25655077f86e2c774d4ca8b4280c0a258c69b148f1e221a5c127ceb898a0e83b1dd
SHA5123dddb7f52f12d06c7904d1b02a22adf0fe23d640e1489047daef7e4a8c0a67b2c4fb4735b3613566959024431a648f9e5a84c52cd518f8594fef2ade3c669f52
-
Filesize
1.4MB
MD54a5282b0e84b55779d33a0e346317a2d
SHA12b1dd5d878f58354eaaedf135d609ba1e662dfee
SHA256c08cb6c1055275021d2a3b50a1391d82f974ee9138f8939c7470aa42a7dcf33d
SHA5129b1a1ce6a0f09a86a27ffef485359b35bf207cf1bfe4b7360815f8c7e6f22a9129850746f9e17acd968177b5277cd902601b47976815a561d6c086a283e7d441
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1.2MB
MD5deb22685b98f4c650c6e831a77eeae31
SHA1df700930d4cfc82439b012b603586635034d586b
SHA25698eb0f18c43fbe97d9bf866981b40da79458c56fa8b5bcfa8cceaa5ed342fb3b
SHA51287a8ee3791996f13411bbdaad5695642c38f09120c12ebfa2051b0af25659e21169e8f6a55619845599be0c931e3f0533470a4cc126e47bf1ccbbf51d2d16647
-
Filesize
46KB
MD58f8fd1988973bac0c5244431473b96a5
SHA1ce81ea37260d7cafe27612606cf044921ad1304c
SHA25627287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e
SHA512a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab
-
Filesize
1KB
MD5138eb7aab174b41fc8305b158213c4a0
SHA1c28117780b6f48d687572eb720a9647d19c9995a
SHA256bd27afb7a9471c64d29874ff8e0b08a2655e230de36558ee7b95c58bcc8d581b
SHA512f5d58dc90a8b54d065df4cd4281b60bcca2cb69af59d34ebb40483a666d08ea56fdc6781bc5e85b679b30e1edd64e6391e26e649258bfff45459ab9cc45027af
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB