Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-09-2024 01:29
General
-
Target
e8117100d5ebd3aa4580e80bf9d2dabf_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e8117100d5ebd3aa4580e80bf9d2dabf
-
SHA1
fce6f07ee2719f8aeed4605302aa59a4a83733d0
-
SHA256
66b88b6a6bbc1178cd69d4730d4e946ac78fd7b7941a7752c269e5526475a48f
-
SHA512
5d088bc52d77f63e74ca665c234c8e6180f8dde3087a3df95c5ec551e89eb32c11618b4fa6ae538bbd16b2d7942293544b769ec3de06748a359633f74aff4c66
-
SSDEEP
24576:tuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:n9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8117100d5ebd3aa4580e80bf9d2dabf_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\pkHfnYA\spinstall.exeC:\Users\Admin\AppData\Local\pkHfnYA\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\oRn0fP\raserver.exeC:\Users\Admin\AppData\Local\oRn0fP\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\km9Va6YWk\sethc.exeC:\Users\Admin\AppData\Local\km9Va6YWk\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD505b8c6a331a6776b48cee4ad77b1d3c5
SHA1120de9605c40e878ca63583804b7c30481ec7c15
SHA25611baa4dbbb2f37695f5de16ad6f2326dc5addc7961a8062f1c76fda4f98da7ec
SHA512efcc45d397ffd925e94929dea3bb414025e0d4907944f011e38af26f38c9fa9d7ce54b8d59dde0084789c9ec7c09115d51e6661fea5e9f3fce2d277189a8d32f
-
Filesize
1.2MB
MD5bc454e54c7f642fbbd61964ddc73cc41
SHA1032072cc16e3b382c197aa494a3fbf5c0d815369
SHA2562281bb810c13b78753b9d2ac9b2d77d6a121be089dd4c08a71d750a84b70b43b
SHA512f1449e60119f9ee798636ff0e697280a10fea64a279833ceeb133c4df0d322a9b523ac53df4efc0d5333ce51021ca792658a6460c29caaabc0f9e1655540bfb3
-
Filesize
1.2MB
MD5cc59a200038ea1971043a808cfdf3c96
SHA12264d7526da3644b54f378440f4818e5f2a3d946
SHA2569f8091e7618146af61161f37afd53fd05c4857f01b7dec6de0683836d775653b
SHA512bb5889f846a56d131c337c30d9b4355688ad9426b69b780c69480af262024bd21875efc4a99643a99a8c88c0c6bc1051b1ecc995701e8ab932199a89334f287b
-
Filesize
1KB
MD5d91c9b2d858ae73387c2bcd349b2051c
SHA17d2953f9443a82b6a80e081eabf11dc74f4a1fd9
SHA25649c1b1a878c32530de52f7551620a24b1375d01f424fee7f0404308eee7405d9
SHA512e3e9784c1b7de3734b9cdfa318bce2a970b10258c8273e0ed2f58be6aca9dbae569ca4b909bdc324cfa550780a58098ece063017d0ed001adc581172ac66f84b
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB