Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 01:30
General
-
Target
f7438adb2b9d8c162cdf100bec85ad75_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f7438adb2b9d8c162cdf100bec85ad75
-
SHA1
f0f7120fb5ed5cad398c73272d21335f3c63ab5f
-
SHA256
afd7750169a65f560917f45bdad20b3785d3b8ea3bb4e4335d6a978ceec931ad
-
SHA512
43624aeb1fd754fd98b02e6bac5e08fe64307ab2f393d8493dda6b2bed8550a01d03ed4730a81c04abc40239c46413f40a81c73565a4a8b6e7c4e8f47aa764ef
-
SSDEEP
24576:3uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:59cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7438adb2b9d8c162cdf100bec85ad75_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\pUj41EH40\dpapimig.exeC:\Users\Admin\AppData\Local\pUj41EH40\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\pEBC\cmstp.exeC:\Users\Admin\AppData\Local\pEBC\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\koq5v8\Utilman.exeC:\Users\Admin\AppData\Local\koq5v8\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD53b1e938471749ceff0809857e6e10c03
SHA189cd7b46b9141d8472e1973b3ff83717526f0c81
SHA2560f572d0da1ab60837dee39a0f108677af632de27b9f29082bd8b5361c0c21502
SHA51279f4f31220a2428fb39eef404ef8e49485d5ce5fb0f2eb006c235afeaf8b1d44f9e4476d88df8bade870db797a59fe1e7a76587686d80d477bbd9670c52eecc7
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
1.2MB
MD57c146829b35cd8e0406694469ad4144b
SHA1f564947a9721a2da55728a735c7efc96592868d4
SHA256e26e537edaac6bb82480beb01f5fcb7d313c0b0faaf79fbb56cbbd0280a186eb
SHA512b64f1f03f2711338e2836beee6193cddf0e5239fe4d7bf582e7b0b89154f61e558a52372dbed38ce6bf469a19c06e74e97d62d4f1c8d5b5c3b169b9df8430f96
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1.4MB
MD547a3b60c5e29386a6203eb9b2164ed1c
SHA1fac0d92197c2362bd0280c1ea787c8249b4aaa0f
SHA256dafc27231589b2cce2f9ddf38c5c96640ccfd08ef971f904eb57961772c945b2
SHA51273ae463c9770badb0d1cdca431255d21121f09214b7539da44c9c0423eb967aa1b4a84186c5324cd008536c6be487fd21a7d797f2e5459f7bd7a82ee27527267
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1KB
MD5042eaf4fc83454b60e6f0c6653b9910c
SHA166a6efcb92b006e6e9eded49dd79d0e2a15608ac
SHA256203f1423122095c943f461776311bcbfa38886409860964d3e20e4cf1da82113
SHA512c5d9abc252f425ce04cc5410020dcec5ead5b9d53653327153fc6982a4ddefc77a78e9ec43e10ecd383bca55630439b82c5f2715d353edcf80c9ec8e30841ffa
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB