Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 06:37
General
-
Target
JaffaCakes118_09024a26ea677d735c4a1e3041f73765.dll
-
Size
1.4MB
-
MD5
09024a26ea677d735c4a1e3041f73765
-
SHA1
f624aa4dc24cd5df1546737fed4da1bee587a279
-
SHA256
92a1adc462adbf747ec142eeeab2dc55aa0e809c678116fad23ea8c8a80ad1cf
-
SHA512
cfe7cc6a44a331b23eecc95af148e9f220b9ac5eb2b0dc241c29499f9f8d16124ff096c56161d824786034fc11ac054ca37e513494d5522505708fc7c3aa5160
-
SSDEEP
12288:ddMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:TMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09024a26ea677d735c4a1e3041f73765.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Users\Admin\AppData\Local\zrRx\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\zrRx\ApplicationFrameHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\phoneactivate.exeC:\Windows\system32\phoneactivate.exe1⤵
-
C:\Users\Admin\AppData\Local\3PIgK\phoneactivate.exeC:\Users\Admin\AppData\Local\3PIgK\phoneactivate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\Ytwp\sethc.exeC:\Users\Admin\AppData\Local\Ytwp\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5940fe0c8646986308870352e39a09eac
SHA125fd8a4cc95c8cb4763de5f4f3cc897dbcdfa976
SHA256c11263df72a1324857ab3b0a9f4dbecf81178df8a48092d78fa2caad3bb6ecff
SHA5122c07e49e831c28e754213719d4c97c1533d31c9ff2fe3b73fe99350d6a8624168bc832fc48a4c96a92da4ec21102f11b23184431b8daafb68ff860900aabbdcb
-
Filesize
107KB
MD532c31f06e0b68f349f68afdd08e45f3d
SHA1e4b642f887e2c1d76b6b4777ade91e3cb3b9e27c
SHA256cea83eb34233fed5ebeef8745c7c581a8adbefbcfc0e30e2d30a81000c821017
SHA512fe61764b471465b164c9c2202ed349605117d57ceb0eca75acf8bda44e8744c115767ee0caed0b7feb70ba37b477d00805b3fdf0d0fa879dd4c8e3c1dc1c0d26
-
Filesize
1.7MB
MD5b268a61fe3208005bc02716c39d814b2
SHA1818c043a4418eb4f44f1ee63ef2b9a41a3cd3371
SHA256d749925b87a5fd6b19e866843839c924f7ab71950848ac39fa3109f4c79d6a5b
SHA512ce330cc0791456ef9481cd899331f90579128643d6e6a9f6d3275480ff22c9262f3d8820a7b4396c9f5d850f97faf9833e2aa41ea53f66742a9ce7782c6b93b6
-
Filesize
104KB
MD58ba3a9702a3f1799431cad6a290223a6
SHA19c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
1.4MB
MD5d8869ae3f88cfa6cf329021615f5ca50
SHA16784f93a48ab96c93224443fbeff01b88edde98a
SHA2568c090ad1a31d636519ec6d634039714c9879f266f8ef4843e8ec226375c4c322
SHA5124bb7d601dc85042ba6a0b0bba8539945d3605c64b02052abb91df648447711ff1392ed0223691df5e9b86f726949ba470dab7badb14c27fc786fe8ed8c01c41f
-
Filesize
1KB
MD515102e74ba9ccae411cf0c160b26a7e2
SHA152dfe3117fb4b66a11a045217c10a7611aea22da
SHA2567edcf2ac3b5cd13b2629c6edb615a1c165377efc9802fcace6fd04bcd012f926
SHA512b76b78d24022b7b5090701477df10254191e2d74964ec1eaa878948a263e2e2087930f540c3862b85f1199dded6fc73374ae914165b558582bd2167e6ac1b839
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB