Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 17:51
General
-
Target
f286092e8fe5d17abc765a52b10751ab_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f286092e8fe5d17abc765a52b10751ab
-
SHA1
b61edfebd10a23144d9a57f18ab23793a03e3acb
-
SHA256
3669fd31aaec1ed1c3de1f93b27b2b662ccc5c02957edca53da6f7a7072488f3
-
SHA512
75c27d2e52dd9cb29770da557d3360229d213871c70ba84dfab092eaabe1a42c1a363b66207a8b1d0d95ba7cf0a541be95cf40f781455df29be75a7a24ecfed2
-
SSDEEP
24576:HVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:HV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f286092e8fe5d17abc765a52b10751ab_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\vGGeHO\Utilman.exeC:\Users\Admin\AppData\Local\vGGeHO\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Users\Admin\AppData\Local\L0mBRes\rdpinput.exeC:\Users\Admin\AppData\Local\L0mBRes\rdpinput.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\a5UD\CloudNotifications.exeC:\Users\Admin\AppData\Local\a5UD\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58349be4942108af497196b1e900488c2
SHA1af783dd7ec4c75a7446b44bd56a626cae190244f
SHA256e974d680e671b54b27a5d84b305fe2458fa9dffc01f68434dc0bc91341517328
SHA5128d9a7ebe5673d7652634edadd22c40a212961206c56ec624e9523d182a5748ed91a70fc6c375a97b475bd410647bad57c82293f0ce5ecd505e685da1d4ac7c7e
-
Filesize
180KB
MD5bd99eeca92869f9a3084d689f335c734
SHA1a2839f6038ea50a4456cd5c2a3ea003e7b77688c
SHA25639bfb2214efeed47f4f5e50e6dff05541e29caeb27966520bdadd52c3d5e7143
SHA512355433c3bbbaa3bcb849633d45713d8a7ac6f87a025732fbe83e259ec3a0cb4eabb18239df26609453f9fc6764c7276c5d0472f11cf12d15ef806aa7594d090e
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
1.2MB
MD57b33b8023c41bab6cce6a4bd8940cc0c
SHA18fad21f05ca23b464c1f8f8dfaeed6ce40e4bb9f
SHA256b8b1f7bb29467f6d55030812b8b576de14ebd5ecdd80610ce438931cf6e3b704
SHA512d8939177680a2634e474cfcb57a85a463fb725fd49b8bdac77da3acd1818aa37b95f03bb4a46d23fd6ff0eac8f178e48d3ae8dcc3c53d2831e2e9fe8442121d2
-
Filesize
1.2MB
MD56da9ca908979329bb755e2355827c4f4
SHA16206405900678d3db1e7a35914d17efc54146115
SHA2560f37f39d5bd088fbb4246fb3d08d053ec48d3c2a1a445129fc2914357a402d37
SHA51299f4145ba8dc7f3e3e41c6a45b47da4da7cb4a5d515870229e757b1be61e408363460ef98ed87c27d8761a751745ce820253ecef0d8280673763e3c73be542f4
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
1KB
MD58e700444da51fb38603721e8394baa31
SHA1fd42798349a2a1a18476c3c274e22aa8a06250cc
SHA2568e86e78751838e4d2d678e1418fa6965757e3f430eeff37976625576c760f296
SHA512451cb77087f0ee9d44bae71e7396349b798671715635c7e2962eec331795b7d198e8c0303a4b07a8c569edd8a42a98176d9a07f95652902d7a0aaf7df53d77a4
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB