Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-08-2024 23:10
General
-
Target
bd883d954444136909950a6421d4dd98_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
bd883d954444136909950a6421d4dd98
-
SHA1
fbdc18ca772d8ddd7c2304e52ed35c2c98769d42
-
SHA256
f8dee334edc64c7632389ce96664ef1abdedd74e8aa1f499f08e238dd913dba4
-
SHA512
9adef86f3bc2f49ecae239cbd5f24ae5dbd7811ca8ba0cd6cf15cbe06d62ebc0e22719b5834fee5c0c7cf1f1b14add43c5ab4dd751040799d7f0ea1eb312d65d
-
SSDEEP
24576:rVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:rV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bd883d954444136909950a6421d4dd98_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\iimMgs7\msinfo32.exeC:\Users\Admin\AppData\Local\iimMgs7\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\70rg\Utilman.exeC:\Users\Admin\AppData\Local\70rg\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\dt6hhaap\eudcedit.exeC:\Users\Admin\AppData\Local\dt6hhaap\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5735829a8d0da59cddede4a00c0ae3204
SHA1584d29c252f87549c35be3561c12cd2e9cf71690
SHA2562b4250ab22f11da3566803fbb25c98ec10269dd277d18ecbe9455cdd07413e10
SHA5120949e7929a0a49db44d5b0cab3656bf30dbb08df3fa0931fa396adedb8db8f9d83e1352c0703960c98a39d4bf8d1c0fb84766d09f65cc32e154768912f6d5825
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
1.3MB
MD5a2213357e480b8d1a58395c9bdf753da
SHA1efc7f62bf4ea454a86ff85ad7f9d9782ec36d654
SHA256c433066ffa0bafd864f6c4f48f923d34113f6514a625bb3b971bae722f04722e
SHA512a2b6b5aecccf8180fb6a85445703294ede8678787325817ed86f828b0fb7ddcc4ebd2a39df83790d81670ff25f06fb68b34d6288f3869f6d23f339beee78815b
-
Filesize
365KB
MD5a9de6557179d371938fbe52511b551ce
SHA1def460b4028788ded82dc55c36cb0df28599fd5f
SHA25683c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe
SHA5125790cac8dae16a785b48f790e6645b137f211c1587fb64ea88e743b846ff3a886324afcfef4bebc61f869023b9a22ba925c461dfb2e12497b70f501e6b79153c
-
Filesize
1.2MB
MD5f0790d82d25e0ed14fc86af3df6e6e9c
SHA101e35e91b1fb29364eb32f867dfcf1c08a1fb431
SHA256ea22dc9fc83c1bb30310e0e1184fbbe3e0fa0d9f4a80b4ae0147b1c3184841b6
SHA512ae0f631386b26cf6af3d383338c4eca9692ebe7b8c9779524eee372aac4b71c8f90aefae6fe8921d40ed3a4279594bdd61789f32e87742151a9032014697bff0
-
Filesize
376KB
MD50aed91da63713bf9f881b03a604a1c9d
SHA1b1b2d292cb1a4c13dc243b5eab13afb316a28b9a
SHA2565cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14
SHA51204bca9b321d702122b6e72c2ad15b7cd98924e5dfc3b8dd0e907ea28fd7826d3f72b98c67242b6698594df648d3c2b6b0952bb52a2363b687bbe44a66e830c03
-
Filesize
1KB
MD551601fdd0fc63bdb5be54f2a8e87f8db
SHA1d8a5d9def7b48a4aac1ab149f2e06fbe2e219351
SHA25693923736bd57fde9b6eb1eea93a14648724d5f5cad847277cf620c2efae0d3df
SHA51208c11e147fa0d9fe13c5110c6b366d8a84c3ead9aafcf1522c3a19440fe3dd149eb72b7d5ac360b2d31c73024a5abba43fded5e730d4e5d9583250b97a0eeee0
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB