Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 10:56
General
-
Target
de3a0b9b0192ab009b5fb6780863a6de_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
de3a0b9b0192ab009b5fb6780863a6de
-
SHA1
47201ab5c416f3dc1850be9d9af2d5785ac6eaf0
-
SHA256
8dfde40a120fd5954b84e6b064cbe332f43b877ab1787cce2f9e4552cb077e3b
-
SHA512
bee84eae73e1426f4f8287e3d012189af4ff5ee8659f2800091866584d643a19435f6aa152b322da148b27bb5bf8cf3ad081f30a75cc9dc46ef525f10abffbec
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nb:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de3a0b9b0192ab009b5fb6780863a6de_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\SIiSEfTC\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\SIiSEfTC\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\65Es0kd2x\osk.exeC:\Users\Admin\AppData\Local\65Es0kd2x\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Users\Admin\AppData\Local\DwKMg57\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\DwKMg57\ApplicationFrameHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5ea5537562d6d06d2b18676f098d47e9d
SHA139c643fd07614bf664daff9dfb8d619ae217e133
SHA256c48b9467b4578f0646ceafeb1729a56ee04b06b64310d90a9bc65d0f8bd4386c
SHA512ac305ed382dc3cfc29238f5723ff8104184c08b3c256752f2ce7180ca4851bc9379047f6e8420d29dd88e4cb7e0d015aa89cc246a728188acf6e204c31e71833
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
1.2MB
MD517402d518f908fb79bc08a7db11f4262
SHA1e154c760a6304a445357defeab031bda95d699c5
SHA256a133d78d624dacf5c37c8b0a2013c79ff93a0fd8e2b9bc7ef6d71c85c8a87a23
SHA5128a297092d2f1cc0378aa3aeaf09509f41ad0f636ac88de05ec5ce91fde961e3c6b748ca4013c110cc90d02c23ce1b7f0b35a64ece632bf9fe04f8d95b33a5fb3
-
Filesize
1.2MB
MD5029bd4307d6917107951140bc6dade9c
SHA17de230e0f72a4622597f32c0f28c32ae6983560d
SHA2564721b8e956ba4abcf07f13522c742f1427f55a332b4964e79ea9c401a41f4c78
SHA51258c9a0caf53b860a8295db99dfac1d7374532a2495dad0cc8b2e061a09c94a139d5f52c4f399ead145397a47f8099c72f125b072d05f9f132b7eb5205c6de3c1
-
Filesize
82KB
MD5bf5bc0d70a936890d38d2510ee07a2cd
SHA169d5971fd264d8128f5633db9003afef5fad8f10
SHA256c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA5120e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51
-
Filesize
1KB
MD5389e554664d856dd28a84e3a1cbc96a6
SHA10a1922fc70e11262019f9c195f651248754b3c04
SHA256347f4b4e96525c7973f25481115f970a2431a8b33b6eee8aad3b2d0218e79d0b
SHA5121b451d0b92d2a63495f979aa27d2b5cbf4838a0628d2e475ae5b6165151fe02ecfcf17cd135e84a0f9ffce2699369618236204fdd19e600338988f9e64b5a0da
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB