Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-09-2024 18:15
Static task
static1
Behavioral task
behavioral1
Sample
ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ff18e8259190c79d60bdb5e0ec552404
-
SHA1
ffabe6c627e7824f5ff3d10c3716f03a4ae6dea9
-
SHA256
e65d864ac680a40fcf898cb480e6b6eb2406307973a19b5001edaedefc4b3f7b
-
SHA512
30efef42d9b3874822388b4c6a8c196d518fe560cd0bb12b23f0af3ad82da90533351e518a661a91d850b968b80d505fc2ada5c9dd10127c04ab3e157b1fac47
-
SSDEEP
24576:auYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:C9cKrUqZWLAcU
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1244-5-0x0000000002540000-0x0000000002541000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
pid Process 1900 psr.exe 2192 ComputerDefaults.exe 2856 rrinstaller.exe -
Loads dropped DLL 7 IoCs
pid Process 1244 Process not Found 1900 psr.exe 1244 Process not Found 2192 ComputerDefaults.exe 1244 Process not Found 2856 rrinstaller.exe 1244 Process not Found -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rcoehfpd = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\BvmQU\\ComputerDefaults.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ComputerDefaults.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rrinstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA psr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2096 rundll32.exe 2096 rundll32.exe 2096 rundll32.exe 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2792 1244 Process not Found 31 PID 1244 wrote to memory of 2792 1244 Process not Found 31 PID 1244 wrote to memory of 2792 1244 Process not Found 31 PID 1244 wrote to memory of 1900 1244 Process not Found 32 PID 1244 wrote to memory of 1900 1244 Process not Found 32 PID 1244 wrote to memory of 1900 1244 Process not Found 32 PID 1244 wrote to memory of 2672 1244 Process not Found 33 PID 1244 wrote to memory of 2672 1244 Process not Found 33 PID 1244 wrote to memory of 2672 1244 Process not Found 33 PID 1244 wrote to memory of 2192 1244 Process not Found 34 PID 1244 wrote to memory of 2192 1244 Process not Found 34 PID 1244 wrote to memory of 2192 1244 Process not Found 34 PID 1244 wrote to memory of 2860 1244 Process not Found 35 PID 1244 wrote to memory of 2860 1244 Process not Found 35 PID 1244 wrote to memory of 2860 1244 Process not Found 35 PID 1244 wrote to memory of 2856 1244 Process not Found 36 PID 1244 wrote to memory of 2856 1244 Process not Found 36 PID 1244 wrote to memory of 2856 1244 Process not Found 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2096
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵PID:2792
-
C:\Users\Admin\AppData\Local\iOmmYB\psr.exeC:\Users\Admin\AppData\Local\iOmmYB\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1900
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵PID:2672
-
C:\Users\Admin\AppData\Local\hoGrn5P\ComputerDefaults.exeC:\Users\Admin\AppData\Local\hoGrn5P\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2192
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵PID:2860
-
C:\Users\Admin\AppData\Local\tjMJS7\rrinstaller.exeC:\Users\Admin\AppData\Local\tjMJS7\rrinstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
1.2MB
MD50e8901e6d3c73a919736590e6a252581
SHA1ae016e211e05ed6eaeda3767ed8d01fa477a5e7d
SHA256b6c51115d6e9eb178ad855dfabfed9896623fea804c718cf2298ac4f2d7684c0
SHA512a8d05136febacfffdc7b56b2508e459f49daa7008b363019e781b4f25f4727a8a72f4a1f31bbe380d9972710fcb79a7780e71bb12e97fddce0146bc45418c1ce
-
Filesize
1.2MB
MD5761880a0673efe341bec445a6c6ac548
SHA14e977e0019e84376d93c21a64e3dcf711e7a4421
SHA256189c669c126ac8e04910d043ce9858257c457b7bb6158ccf57e81ebf2645d3d8
SHA5126f6b734f42db6ebbcdcf4bfd638958e25771b067f9cb2e321b657a75efcfe783106886588cce839c1cdf017802bba4d6af53396bb10c0480c36247c7e9565a5a
-
Filesize
54KB
MD50d3a73b0b30252680b383532f1758649
SHA19f098d2037e4dd94eca6d04c37b3d4ad8b0cc931
SHA256fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc
SHA512a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4
-
Filesize
1KB
MD538bd488124b132d0cbe8a997577fc1cf
SHA1b4dc89c195e93c757901643e4e3ab03359faac35
SHA2561d23cb183be90c35e7e79e32179974e2871a7ac4a3ec73a46b4ed75c34a90d0a
SHA51275802ea3e41a373b1f57ffdc523ae252d8482350a5dfcdc670d5f95dd745180d35b8684145d55c8c3247baa0bdd6d3a7662fe5a519e79046983378a6f88198d2
-
Filesize
1.2MB
MD5bde577c36ebe4ef6b1f3532eb1bd36e2
SHA16c3676f6f1ef79053fa465f13e8846c27a963125
SHA256da19a2e6c5baa31c7f9a4aecad10c30704320b0fe4a004901ca1cf35aa78159a
SHA51259f1e554cd98f2af123c28a7fe4d10735e53be0b6cea3fed93829bd9960aa46ba67c3d9e728938d51410b434a09713e6465f958f693dcbc26c5199593d28a84c
-
Filesize
715KB
MD5a80527109d75cba125d940b007eea151
SHA1facf32a9ede6abfaa09368bfdfcfec8554107272
SHA25668910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495
SHA51277b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774