Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-10-2024 05:31
General
-
Target
2bbced116fdb8fc62616ebecff5923b0_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2bbced116fdb8fc62616ebecff5923b0
-
SHA1
08c7486f88a21923f42b1da93f80e518be7e2332
-
SHA256
c946e2a27a0c8eb2dd4bbffd200e12eb98ecec7ac2b41ae21b86ce6197e2444b
-
SHA512
e581584c16497af995212caf6f80011fdded57e02184293ff9d67c07d552a96e70655af54d1be9f28f12445f43ae578480c400d559528622e5e060e3c1b361d4
-
SSDEEP
12288:qVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:3fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2bbced116fdb8fc62616ebecff5923b0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wisptis.exeC:\Windows\system32\wisptis.exe1⤵
-
C:\Users\Admin\AppData\Local\rgqx5Jti\wisptis.exeC:\Users\Admin\AppData\Local\rgqx5Jti\wisptis.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\tIy\osk.exeC:\Users\Admin\AppData\Local\tIy\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\G8FN\rdpshell.exeC:\Users\Admin\AppData\Local\G8FN\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD579452303bc9b94e5fe20fc106bba8ba7
SHA129d9f4cf4a5d1de0a3bbf69b4705348335e75e6d
SHA256a6b416b3ba3085dbaf5d4a4d7dd4f8d406e87f1b8c2fb1b39e5f72feb9e75743
SHA5128e6e139db298aa9c108892c3ec310cf0401c8f2e31ac4a4d2b9b5ab8a1efff5f1fd017827c84eced879b0d0e875a74903b1b9d26ef14aaa1abb347d49df6a506
-
Filesize
1.2MB
MD57f909a22014a8501bc85ad485bc2d30c
SHA176783ad38cc381a7654589d371555b281ea63ed4
SHA256582e752bce102c722cdea42a2e7b8c33904bcf6998513ea8aca35bd73053a8df
SHA51221ea735c492e333136f976a131c5caeb45fb65027affbc2538acc3c4f18eb15c022ad45cc639c7f0996a0035f58ec7d8136d1aacf4a245c1d3dc594980624853
-
Filesize
1KB
MD53b6f825e7cb65031d0f89041cb22b39d
SHA19b68149096a5f20556e4f605d22e987a9c4e5c47
SHA2562f48d964b6f03bc6432dcc57bad27a95f4a6498d0f564ad16bdb5ef5f1d9a955
SHA51260618d6743a1aff68752543c4f49e247b91650f2b2758714167359be9938e9b6e663633c8e97b52b32b26f645af04c8d0a217ab6ad961af22e21da40dd867509
-
Filesize
1.2MB
MD53ece23f07a5ed443476e122a6e34b0e5
SHA1ca2d0a02ceaf3ff191271f8b88b0a21caa5d8635
SHA256b30058604ce582da4cc8520e993f5c38b5abfc86cc5652911cc37884c9eb2ac3
SHA5123d556a07d12de7e106aa890cebbd54b668c1acc6c1bf162a6e06daac1c57b808c170b2ceedd62ff686a5e0fc19d4a5764dc4f8f1138e2270b6a01d52cb70f552
-
Filesize
292KB
MD5a62dfcea3a58ba8fcf32f831f018fe3f
SHA175f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b
SHA256f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e
SHA5129a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603
-
Filesize
396KB
MD502e20372d9d6d28e37ba9704edc90b67
SHA1d7d18ba0df95c3507bf20be8d72e25c5d11ab40c
SHA2563338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144
SHA512bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB