Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-12-2024 15:46
General
-
Target
d7d1a4ad90104b8715abe6ff3177b2ad_JaffaCakes118.dll
-
Size
956KB
-
MD5
d7d1a4ad90104b8715abe6ff3177b2ad
-
SHA1
37f2096b6d18dc5d928e8e58d811b28ecc83f762
-
SHA256
7fab9e0fd730a322d526345ff7be62c4136e27a65bce62426db888db72811d81
-
SHA512
a0edc3a1827783ccc78bb375ffc3d8fa36f81f3d6021b39dbab2a473ae0ee3256b06bbb99172fded761b4ecd355a4bae2baa2e38f572d3912086a036d375e4b6
-
SSDEEP
12288:+hEYeww+UVOnx3HUx88QnugdBcqfoeC1XE/fTPcCHfla:kxwq34ZStD1foeCmDPc
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7d1a4ad90104b8715abe6ff3177b2ad_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Narrator.exeC:\Windows\system32\Narrator.exe1⤵
-
C:\Users\Admin\AppData\Local\vfqS2v8o\Narrator.exeC:\Users\Admin\AppData\Local\vfqS2v8o\Narrator.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\5cm7JF6\BdeUISrv.exeC:\Users\Admin\AppData\Local\5cm7JF6\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\f7YpbuIo\upfc.exeC:\Users\Admin\AppData\Local\f7YpbuIo\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\B3CLQc\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\B3CLQc\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
960KB
MD5f9f1753d1abc4ab2c4e11ca109e978e9
SHA1d844bd38ef4c4f2c425454c114b2852e3998eae0
SHA25655ea2ad443a169f0809d6f2c06bac0eb190b0965a751935fc79b0d4fa8c8bb4a
SHA5121b0f85b0b6d6049482590f44cccce80900c99bef88cde8d186d93b5916f57fddf83228e3946502cfd82b2b893587257b766fd52119955dc25a2bfcc1aafdc16b
-
Filesize
960KB
MD5ef79d7070b3de20dc35f8698991559b4
SHA1fb065ea8305451da204b3b22303bba28cf0cf418
SHA25612dfbe3911ecc534bcb46d8f4a34b32227f863b84b7f5266d0080cae36722509
SHA5124faa6fbc39805cc204e41baf7a9fcd982e0560d07f68778f2df31aee107519e4c6018f087f2dd208ee3c4a4d47c56bf695cac485d00ee470e9b5a57f4ab1251f
-
Filesize
82KB
MD5fa040b18d2d2061ab38cf4e52e753854
SHA1b1b37124e9afd6c860189ce4d49cebbb2e4c57bc
SHA256c61fa0f8c5d8d61110adbcceaa453a6c1d31255b3244dc7e3b605a4a931c245c
SHA512511f5981bd2c446f1f3039f6674f972651512305630bd688b1ef159af36a23cb836b43d7010b132a86b5f4d6c46206057abd31600f1e7dc930cb32ed962298a4
-
Filesize
960KB
MD539742a44ced3cb907b09b871e1a016dc
SHA1445039d8858f7f6e82a438c57d3633d7587e9e25
SHA25648df7985026af904e1187e31a0e0d17b747cf8a282744de4501dca292ecede20
SHA5124d565a3793d0d5cc966c97be01b5dcda7fa82d3f8bfb4fe7598a2f25244580ebe5d95ad69ad88cada6d22bc9bf40e4d02ed1fbd057dfe3630d97bc3683a67b54
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
521KB
MD5d92defaa4d346278480d2780325d8d18
SHA16494d55b2e5064ffe8add579edfcd13c3e69fffe
SHA25669b8c93d9b262b36e2bdc223cc0d6e312cc471b49d7cc36befbba1f863a05d83
SHA512b82c0fbc07361e4ad6e4ab171e55e1e41e9312ba995dce90696ca90f734f5d1ea11371ca046e8680ea566a1c2e0643ab86f1f6dcf6cbd05aed8448425a2830b5
-
Filesize
1KB
MD5b03bc9666f2a0814756d42cb33c0b558
SHA1aee83a0e931de19cd16745cc797b22cb6f7c2ebc
SHA256fe826503b46902a5b9a7112c52ef14fd98ea1d45a039b63cc29be8cc702e11c3
SHA5125bc69cf916e58dc986dce323dac4f07671977fb05e71b2cd46e2b9292f029c86513a0e9cf626ce9fb306feb477019f407fd10b25246d7962c9e6027d7145c31d
-
Filesize
960KB
-
Filesize
956KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
64KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
64KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
956KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
28KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
28KB