Analysis
-
max time kernel
115s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 22:36
General
-
Target
910c0c807fac1d91d4f2c0e1b40669f8_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
910c0c807fac1d91d4f2c0e1b40669f8
-
SHA1
837bd3d884170bb6b23de202e9cb17d0964ebfdb
-
SHA256
7ec10a17f6970d4d8db9ee8b26fb8dff79a3d8a666701c91ca856f1e023df29d
-
SHA512
b1a059f9bf9d401080d61e9c599dc2ac742483f72ff5fa5bb80a2d8511044af4922bf302625ba9c5124a4b69e1e9f7ed1808e19885bc6c66e3136f84b8bb874e
-
SSDEEP
12288:pVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:IfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\910c0c807fac1d91d4f2c0e1b40669f8_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\3S2\OptionalFeatures.exeC:\Users\Admin\AppData\Local\3S2\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\RZJge\DisplaySwitch.exeC:\Users\Admin\AppData\Local\RZJge\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\sudY\UI0Detect.exeC:\Users\Admin\AppData\Local\sudY\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
517KB
MD5b795e6138e29a37508285fc31e92bd78
SHA1d0fe0c38c7c61adbb77e58d48b96cd4bf98ecd4a
SHA25601a9733871baa8518092bade3fce62dcca14cdf6fc55b98218253580b38d7659
SHA5128312174a77bab5fef7c4e9efff66c43d3515b02f5766ed1d3b9bd0abb3d7344a9a22cbac228132098428c122293d2b1898b3a2d75f5e4247b1dcb9aa9c7913b1
-
Filesize
1KB
MD5eed252f97306b3c40493dfbe028f492b
SHA196d0e94efd31ed1d6a6420f057e55f80ee39dce5
SHA2565389b736803fa1f52e708204ecafe1df9b80816a7c2eab40678b9ff16f3e3de0
SHA5124f098c31237ab9c37b3fbacaa1be93822ef82ca059c0a1c8d5390b097cfed22a514fc873b518ca983bad818d1e49eb2043d5d245f6780a9014c63bbc1ba7a9ad
-
Filesize
1.2MB
MD59fdf95354bd2a62e31c262addb3de99f
SHA144d470c13b124ac19521dd6665da6af5ba4f329f
SHA256efd6943c5b16720a78ad8314ef42fad303a90e1d28191b93766d84d74c96ccbf
SHA512671e518ca79f8fd647d7985c53acbe753869686b950e64e5445cd24357b146267c59a05debb0bb765e9461b3935fc90ff2e149b85f879154f1e9f7362661db96
-
Filesize
1.2MB
MD5b4b8d6bf90b6803033974be6e20b093b
SHA1fb9359c7b46afc4a6efa7d22dadd457d91ed269a
SHA256d325048201d4b9c7ab116d895bd0d8b06a897d524be8190eebf6ecd13861f5fb
SHA5121ea438a4481620165d7ce63ee59065818a9d39434de4d3dbb62fdb04cb2aafbd904db40df642d376a8a1798a7948945169796e34f1172a1ac702275b4c6b2829
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
1.2MB
MD5289186a44104d01d9e9fb8fe93492324
SHA1a0ad1761dc31c5974de722154715d4a1ee3b6270
SHA2568d8cfe9c2de3e3cb44775c22db51bf78e8a199744f286aa5d479bb205aef1393
SHA512069fe76443fbe03e60f07111119d26bc6f416a279ed7e2561ef8ef0cd22f411a1838e5aa29a9e4a884867ab4be704a7783985d8779ef43847c55be119d6ea555
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB