Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
23-08-2024 07:49
General
-
Target
bae550212bff99a8b207f64a7f1aee67_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
bae550212bff99a8b207f64a7f1aee67
-
SHA1
987722c97138b18802e34c972e65331c5a77af4a
-
SHA256
20c896c17ea62e174e18810ced89c1f47df84f69e5f94cb5cf11692592c4b993
-
SHA512
009cc39535fe343b5c7288c8620d2cf6157b10c920c19f1c58a59ecf4061b339b934f2bd709d0c2d1f7425c6f69ed48b4dfb4e2b29da72843fb177b075df4659
-
SSDEEP
24576:HuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NJrE:p9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bae550212bff99a8b207f64a7f1aee67_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\SRWw8\wextract.exeC:\Users\Admin\AppData\Local\SRWw8\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\oGA\Magnify.exeC:\Users\Admin\AppData\Local\oGA\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Users\Admin\AppData\Local\ZOCgI7hG7\fvenotify.exeC:\Users\Admin\AppData\Local\ZOCgI7hG7\fvenotify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD53444e74527acfa4752b34cf490971c51
SHA127ade8c16c2b1e0c7c13641cdf548c170e4071be
SHA2563cef496b3448ed7228c6ff7fb667259e0824612556864d6d21b3dd6d21eb48cd
SHA512cd53d587de6ce9751c4e41e745c4575fd51a5a6f2d0711f0b08bc814983d4e6a98ddd8f3e7f4698e9b3961e2d8ad211287bc8466911ada75e0cb476fccf3e28d
-
Filesize
1.2MB
MD5db2f53420f1b30f4db670d2cdebe0500
SHA147de1fb8ded682c70b9118ae9806549fd4b910ad
SHA25642752127a5d9be02f3f2132384806c44116bff1971bc059ddeb75c28268b95a3
SHA5122671582f079e265ff091d14d0ade4a415861f8151ece171c1aa2b62740e248e0ac221ba9c95c215c3a135a0824c255ad32720036190cefe275df19cd3de25118
-
Filesize
1.2MB
MD54cb6ad31f4f2c13319b987d02f31306d
SHA11a768a5388ae0987fc6bd88367682c1702033885
SHA256ac873f2d57902871c397de4268d70fee08a6b7a506f71d1141f7d140c0a29207
SHA512380a44dc547b99165b22b6db9a006dd3830a9f09dae49180c45ba426f161d50b742d8acaf7104e84c4bee36e37683bc93975ff992d3a380c065e3cf88606a9fc
-
Filesize
1KB
MD5331c4ca0661eeb5693b1ddc4a84255e9
SHA158c4ac1cefab3e72980ede437f45ec7b7242205c
SHA25651f4237e318a3103e7cda37c97fdfdbfc4d34e13ab3c63eca96093f11bf48cf2
SHA512ef42cc28e9b30690c30acbb2af07cf00885ddc668ef774e1aa5303c95ce9d135241518ef8f0d52746f9b6bd0a6dbc1e94295a2629859421397166719f8e41a96
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
637KB
MD5233b45ddf77bd45e53872881cff1839b
SHA1d4b8cafce4664bb339859a90a9dd1506f831756d
SHA256adfd109ec03cd57e44dbd5fd1c4d8c47f8f58f887f690ba3c92f744b670fd75a
SHA5126fb5f730633bfb2d063e6bc8cf37a7624bdcde2bd1d0c92b6b9a557484e7acf5d3a2be354808cade751f7ac5c5fe936e765f6494ef54b4fdb2725179f0d0fe39
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB