Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-08-2024 16:30
General
-
Target
b8582e40b778541ea3445524e95735f2_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b8582e40b778541ea3445524e95735f2
-
SHA1
bc13cb980db1cac969ca37b8bdcf9dc7226940d5
-
SHA256
fae74f1cdc0e33a7bef8b67415b052be1cccb05d1f420a1ca2e03a9928c02280
-
SHA512
8a66492bad9431a5a928cce016d4639a011161fcd9caa35bc74cffce4dd1f73e2ed8b79cf0599128ebaa05f298bc88821751b63938d90059347dd1e4848a541a
-
SSDEEP
24576:DuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:t9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b8582e40b778541ea3445524e95735f2_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\8bqD\osk.exeC:\Users\Admin\AppData\Local\8bqD\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\KHAg\tabcal.exeC:\Users\Admin\AppData\Local\KHAg\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LockScreenContentServer.exeC:\Windows\system32\LockScreenContentServer.exe1⤵
-
C:\Users\Admin\AppData\Local\AiiOQqo9\LockScreenContentServer.exeC:\Users\Admin\AppData\Local\AiiOQqo9\LockScreenContentServer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD55bfb703da6d5be43d368318f5805c8bc
SHA1f3ce3e92e638598e2464e347d532ceafa302f2ab
SHA256ce9c01354508cf7e2dfb6142c9e15160699aee0e6fe50df7c82407ea52a220ca
SHA5123b07215a3f3ba83c438b1578290e97950463e4dc9dcc400433039aec349d0080f08fd2b2bc02275e39dfd333b6ac0ce1e73941f8f944eff6fa4d265b2080f764
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
47KB
MD5a0b7513c98cf46ca2cea3a567fec137c
SHA12307fc8e3fc620ea3c2fdc6248ad4658479ba995
SHA256cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6
SHA5123928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15
-
Filesize
1.2MB
MD5c70b638f3d64cdc75c79cd3218360c00
SHA1ca0b262234197ea3648029b40325236cbaf02ff4
SHA256cffc6ead7965c1e9c0a7d729bac55237da18a1b6459e79bcf241a8ede8a492c9
SHA51207eadb6cf2a18af15104f0dedfe7aba0ebf57f8ba147e9a7a599709e87b1fefd0bbb8e18f6f564671ee07c2e08696b854e3a53041953eb3e49edde5d7e607490
-
Filesize
1.2MB
MD5bb500aa39495eceee52cb8f890afefc4
SHA1db76a3b492fc49ec874d95338173026c01eff9ad
SHA25698e714edb9c2469f2c897264fc4cad3e2aa475699c10c2616cdd380999b824bb
SHA51261e01fd0454484c011cee1f71b890175ab99ed614de8ae0d77bc38088b242ef81ea964d7c7c3db49077b9ea0f503026cfeb5b85b479e00454617107a75e99b1b
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
1KB
MD503855c0b5fc98894fa216c05f2b731e1
SHA1e40210aefa29d25338fa856186298f4e8ee464f8
SHA2563488d1bbc0a07680c169956362b3e17e369b097dfeded5899961859d458efee1
SHA512784003039934ece6b681785d17ee0ba9a2ed2cb36f011e05fd3e83023f591beed11d319e3fb0f2586ef6281cd50b6081666c17d6fb362293ae4bfa55e12ed0ca
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB