Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-08-2024 20:31
General
-
Target
b4ef573d73853151ed754c832c6b07d0_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b4ef573d73853151ed754c832c6b07d0
-
SHA1
5004eb22738a95e3b67020f946e585c73fc47d89
-
SHA256
1420e1c8cabda4b1e776f53d3da09b518192642228c48f781ef4db55e8da11e3
-
SHA512
b82eea4718ce1cb783f7bdcf29a3cf9bc1eeaf53624efedd0ec368588f13e473d33dcd697274a89e0201d55cbb277f97da246e3be29087351d73cbe027f0933a
-
SSDEEP
24576:tuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:n9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4ef573d73853151ed754c832c6b07d0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\Nmg63cB\cmstp.exeC:\Users\Admin\AppData\Local\Nmg63cB\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\77rwScgv\tcmsetup.exeC:\Users\Admin\AppData\Local\77rwScgv\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\Zp5\DisplaySwitch.exeC:\Users\Admin\AppData\Local\Zp5\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e3eeba8f987889eede98ef75d51ed694
SHA1ed777c9580d0013adc2dc36273f0dbe0682b891b
SHA25699eafb97adff82826b0124710396f7f1133f757a60637034bdbc8bbb3886652f
SHA5127c2aa2594e314dfe37842fe264d6b283949214db6fd884c7bd872564dce51db08b2bbe56d2e29ddd9dfb52a2115e412680011d94650edeff24a4fc50077c79ba
-
Filesize
16KB
MD558f3b915b9ae7d63431772c2616b0945
SHA16346e837da3b0f551becb7cac6d160e3063696e9
SHA256e243501ba2ef7a6f04f51410bb916faffe0ec23450a4d030ce6bfe747e544b39
SHA5127b09192af460c502d1a94989a0d06191c8c7a058ce3a4541e3f45960a1e12529d0cdaff9da3d5bacfdceed57aeb6dc9a159c6c0a95675c438f99bf7e418c6dc5
-
Filesize
1.2MB
MD5b9ca5320128b3ddd51c5b270c29bfb8b
SHA1dd547e11991ceb5421f7e308b000ef124c6f6591
SHA2569eff9ba2a59e4dfe03d31bead5c6d577052aafa2f1a450100b836c6acddcec3c
SHA512dd6b8e40dd7ef1ab5486dd0aeeebf1bc1dd45eb14f387e93472095f5cb01770284af866b74949f6072a0e018d1d2fde20c4e3ff26dc2014b8385bc8838308e35
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
1.2MB
MD524965386162e571ae8f9e27eab1defc7
SHA1c602772aa36ff4342a07a67de25e4ca4feaacdcf
SHA25695eecff83cdb5e92fb6149355a8ef5d389f1afa8ffed29dbbd8b7b06bc084a69
SHA512105d25c4fca2ffb3552578879db1c8eb33cbe0b6a92a14d475a4291dd23699ee27e89a879e290d94efaea5a0e1400eb2d9223807eb9fc94ecb0d5b98a544b59e
-
Filesize
1KB
MD5629fc5668dbcd7384f12c7f6a0ff40ea
SHA133552e2c9fce26e1b2ab1fb3512116f36591e5fb
SHA256190a8f3d23684e954fe9430da795d67fd37cc044ecc06e3310ebbd32f26b71ba
SHA5127710bf70631c3fada91a32d1f474fd7fbd95e3a107826dc166fc6dc0efb842c58d959c6763290d32f06e7bbc6537cbb5f7575d616695973e8782237bfc56c7d3
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB