Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-08-2024 17:01
General
-
Target
9f37c38c61838641d596841f6a1232ff_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
9f37c38c61838641d596841f6a1232ff
-
SHA1
3334ad56daf32d68440ffcd6c838142c5822e650
-
SHA256
f0e9f3d5fced9258fdb6791c781c6844a172502786b058db47ce483493b1941d
-
SHA512
5fe41be56f5c65084cf13892da63eb9b33d6ef39a0214c14ea242d12aecdeeb85609cd2fc0638834bcbd4353ae087f1da443de756aeb00d586803f9629c0ab76
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Ns:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f37c38c61838641d596841f6a1232ff_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\7bQmZDjL\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\7bQmZDjL\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\FxxvBft\AtBroker.exeC:\Users\Admin\AppData\Local\FxxvBft\AtBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\ZoyMoF\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\ZoyMoF\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD57d9f7d042de840f929d8cf30ccac1832
SHA1e9660ea9b6b82e370022d146258221dd5d7342c3
SHA25633256e6212bd82bf17aaf7bbe4cd96462cd6b42900037b78ce5647cf9f614c6e
SHA5122ca2f2982b3b66bcaea5a101a0bf6ed281ca594c73a64d0998e5b74d19567773ca66e5e4ec902242b5ba12272046b059d5d86d6ea738678acc86e9a5f65dd6c7
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
90KB
MD530076e434a015bdf4c136e09351882cc
SHA1584c958a35e23083a0861421357405afd26d9a0c
SHA256ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd
SHA512675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024
-
Filesize
1.4MB
MD567e6bcb4a1a8343b86f1cee8f95bf6cb
SHA1da613091f658099e9d405ea570e4e959e3265e1e
SHA25606d9e2c9a7dbbaa5308ace2272794442da08c2b221d051964c9672e505f0a3f7
SHA51229a9a2e04b0dfb3f35ee93b4b4d9bf9c40591e2f382287802aeda3d63c48931a54d30d4b1da9d2591010fa0d10865471560f5fb0151b5c31e259c2f1d1d465d7
-
Filesize
1.4MB
MD5fa6d01544abcc5c755dc379a5c2f96e3
SHA1e093e749e357e1e5f92d3233a3fb48a105f175a2
SHA256f0d1697b26286b6b812cf187627ec11c2cae32ae944ee2b9d59195b695c20a8c
SHA512357ab774d4e6d12e0e4cc3c5f06b456591793afec7d272e93c638b1160bee515d1107dcfa4b2c545e5a9fd62e13f64457f05521291518d91aaba058868990d17
-
Filesize
82KB
MD5fa040b18d2d2061ab38cf4e52e753854
SHA1b1b37124e9afd6c860189ce4d49cebbb2e4c57bc
SHA256c61fa0f8c5d8d61110adbcceaa453a6c1d31255b3244dc7e3b605a4a931c245c
SHA512511f5981bd2c446f1f3039f6674f972651512305630bd688b1ef159af36a23cb836b43d7010b132a86b5f4d6c46206057abd31600f1e7dc930cb32ed962298a4
-
Filesize
1KB
MD5a612484266bdb97e5dc712df8eb34046
SHA1327e57b4e36ec4aacd3641e340d342f55a8daf29
SHA256042e7bae996db0bc0eadfa25954d43676b66639693a91a74e745ed7f5e9ef7b7
SHA5128bec9e65dcc7e51288479142a5c9a6e9fcf96ed25ee3f7be7d98a1d59a9fa7da20b255e198911220677ce76337780233ebe376ecfcaf659b69c8565d0094db18
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB