Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-08-2024 23:41
General
-
Target
a0682d74e106b09ade2106ede229c053_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a0682d74e106b09ade2106ede229c053
-
SHA1
9fe391db18b3625649adf27e339e81003318dda6
-
SHA256
0f22dce9cc7521ce92c5b64195b89405390cebe4f68a95852c92e1393d5ab821
-
SHA512
3093e13ab01081095346941f710fda9c9ad53377719880366441a8a28543ca120cf47fa6abae2b863fa30a0076b675e51233cdf7e8d9a6ca463b77afcb9bce31
-
SSDEEP
24576:KuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:S9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a0682d74e106b09ade2106ede229c053_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\iR6\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\iR6\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\WHaa\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\WHaa\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\cfJvGRTX\Magnify.exeC:\Users\Admin\AppData\Local\cfJvGRTX\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD51f09bb65f1bfc27400457a1b1eab42fc
SHA1d2bc52dfcc896c6269ccf9a1f80704f55892eb3a
SHA2563a4d3ff78285c5a73410e0d631a1e29a9762d08f85c2e533ca698d96cce296fa
SHA51274577ae4d39a13779faec35ebca4b14c72b967ec6b3cbfc185de84196d309fafacd3cc4282396d0e1729fc46524ad9706f6d76ea07354c43b5e3c0647125953f
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
639KB
MD54029890c147e3b4c6f41dfb5f9834d42
SHA110d08b3f6dabe8171ca2dd52e5737e3402951c75
SHA25657137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d
SHA512dbdc60f8692f13c23dbed0b76e9c6758a5b413bd6aaf4e4d0ba74e69c0871eb759da95c3f85a31d972388b545dcf3bb8abbcbedd29a1e7e48c065130b98b893d
-
Filesize
1.2MB
MD5459c0480b10c2be7cbbafb344078b2d0
SHA110a03ff73774dd5f5c0622f200dd24611d69c740
SHA2564334715e9337e1aba0cde4edd510c7e1436fbaa47bc3219f10d3e078a08fec70
SHA51263bf0a56d0ce64029e131732cec3d3c336a696d6f00353198d48ad0a383945ced07e9437423fef9b5ae504a23219c0b5cce13b1f312da6f4d1b135fab8a4d489
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
1.2MB
MD543a02418331a91f31f456dcd9d7ba789
SHA16d5fc9e3fdaa0c2a2433626886e094359e6bc9f3
SHA2561d5842338d49f4ea9fe26f24aa341bef86772ff81b6eb03bc6ddf81410060846
SHA512b7516167d6d63994104cb0e0e6f17bb896a49504d0e184dc6fc9466cc47d44a017595d9e2d3c9837c108408b673c914cabdb5b0ea150c89bdcb4554a4f33b43c
-
Filesize
1KB
MD53d445850e84c1aeafa344c84987eb312
SHA1d0e95f999ef830b4104266cb47b3428dc513b5a3
SHA25613578e6d7ba6e058d1fe10a066575ff8fde00217b9dc8364181844f4474d7292
SHA5128f088b95ca24ffdc9ed0968ba85f6ebe6324be72a0401a574f94a5a33b3e105ae3ecf1d8a8f540b507954c884d5a4a647dccfb6ed7c50402f83aa09968a62727
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB