Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-08-2024 06:41
General
-
Target
b273fa97431153c131b5b9ae8d6f85b7_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b273fa97431153c131b5b9ae8d6f85b7
-
SHA1
6747bd7ef216cdf6d23e500c2ca8c41e851b109e
-
SHA256
f487a0f3b8ef34854390d1f67b57ead543c6a940a74bf00699264c183533cbe6
-
SHA512
6bc9e750e65ae49fa76d6fc1447b3386c79cf434871e75a5b6f2307ccd35b9105c8b6e5eafd610e618ce36ac4089cecd2c739ed05cb9bf9944327b40fcbc2e1c
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b273fa97431153c131b5b9ae8d6f85b7_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\GnXS5iq2F\DisplaySwitch.exeC:\Users\Admin\AppData\Local\GnXS5iq2F\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\bNO7\sppsvc.exeC:\Users\Admin\AppData\Local\bNO7\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\cYZ6RmKj\DeviceEnroller.exeC:\Users\Admin\AppData\Local\cYZ6RmKj\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
1.2MB
MD5a3973620aa36d705a378f9cd803c7b19
SHA1d5b65c77ae6e63c82dd66a8937b5fec4063ae4ec
SHA2569ff16c01c4ddc25a2f0a7a89327fc14e760d6843c354afc50bcb9e19840fb28c
SHA512f801932217ff14b22a85a8c1384673614fd573148884a000da228918f07763c45aaa0ea781b652cfeb7481cbe61f23297eee20e8199a616b8a1b7aed475d87d7
-
Filesize
1.2MB
MD541c23bc8cc0a75150aef994ef91fe3a2
SHA1ea63a8459fb62e7d5345755ad736e06840d70f47
SHA2563aa9e05b7c3b034f5172ff150b63704b79c6dc771bb7a98f31dc906f029cb1eb
SHA5120b7a56ebbbb3cbc960592aad190f8706967725807cba575aafed8e78c3cb49174d481bdd63ba4b1e008fd7a35b1524546f5e68da12926accdddf2d8ed0c32c94
-
Filesize
4.4MB
MD5ec6cef0a81f167668e18fa32f1606fce
SHA16d56837a388ae5573a38a439cee16e6dde5b4de8
SHA25682c59a2f606ebf1a8a0de16be150600ac63ad8351c6bf3952c27a70257cb70f8
SHA512f40b37675329ca7875d958b4b0019082548a563ada217c7431c2ca5c7f93957b242f095f7f04bcdd6240b97ea99e89bfe3a003f97c43366d00a93768fef7b4c5
-
Filesize
448KB
MD5946d9474533f58d2613078fd14ca7473
SHA1c2620ac9522fa3702a6a03299b930d6044aa5e49
SHA256cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb
SHA5123653d41a0553ee63a43490f682c9b528651a6336f28adafc333d4d148577351122db8279ff83ee59bb0a9c17bb384e9f6c9c78677c8c5ed671a42036dec1f8c1
-
Filesize
1.2MB
MD515030d55bc644ce6a3bf060b3dbb8611
SHA1ef59c5312f25c9ce7da06651309fb8b8dc0c0493
SHA256f1b1e403d8e6bc0663b2259fa9409386debf4f12ef88ead6258dc83da158b588
SHA51225897a9b132bc1bece0a5469be750f645b0e7b7e585735d885be29811cfec4080e4654fe06a6e10214900674599ebabb8bf76877e08d7766288eac47cca5dbb3
-
Filesize
1KB
MD5ffada1c90e60a6296baf8cda86a84657
SHA1d3bd520e33e2e753e7bd8c251be654dc2f258ee4
SHA256f4d753408b35a4e0ea688c1439a8431bfb7ddce4a8e60cdd32361ea7f1132710
SHA512059d97457d9f8c310c2f177c8d0421289691c534522a48caa4812b667988e05b462406f14e62e487b1b920a09758649f3e3f4d334721c910d425d721efe4a842
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB