Analysis
- max time kernel
122s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
14/04/2024, 22:37
General
- Target efacdaf6d63e2ea75e1fe017e9ca4f58_JaffaCakes118.dll
- Size 2.0MB
- Sample240414-2j3fzaff87
- SHA256 27ed80402df1de8ba936f7c0709d45ca685ccf50aa3d20aab2b5c2bbb144e1ee
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\efacdaf6d63e2ea75e1fe017e9ca4f58_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\JKgPyeN9\sppsvc.exeC:\Users\Admin\AppData\Local\JKgPyeN9\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Dy2SV\sppsvc.exeC:\Users\Admin\AppData\Local\Dy2SV\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\M1d\DWWIN.EXEC:\Users\Admin\AppData\Local\M1d\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
XmlLite.dll
XmlLite.dll
sppsvc.exe
DWWIN.EXE
VERSION.dll
Axoeay.lnk
memory/1612-80-0x0000000140000000-0x00000001401FF000-memory.dmp
memory/1612-79-0x000001BCD2510000-0x000001BCD2517000-memory.dmp
memory/1748-97-0x000002439A010000-0x000002439A017000-memory.dmp
memory/2924-114-0x0000014F57510000-0x0000014F57517000-memory.dmp
memory/3240-37-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-44-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-19-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-20-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-18-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-22-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-21-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-23-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-24-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-25-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-26-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-27-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-28-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-29-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-31-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-30-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-33-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-35-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-32-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-34-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-4-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
memory/3240-36-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-38-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-40-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-41-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-42-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-39-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-17-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-43-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-46-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-47-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-45-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-48-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-49-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-51-0x0000000000B70000-0x0000000000B77000-memory.dmp
memory/3240-50-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-58-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-59-0x00007FFFF6CA0000-0x00007FFFF6CB0000-memory.dmp
memory/3240-68-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-70-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-16-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-15-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-14-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-8-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-13-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-12-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-11-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-10-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3240-9-0x00007FFFF5E3A000-0x00007FFFF5E3B000-memory.dmp
memory/3240-6-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3696-0-0x0000000001430000-0x0000000001437000-memory.dmp
memory/3696-1-0x0000000140000000-0x00000001401FE000-memory.dmp
memory/3696-7-0x0000000140000000-0x00000001401FE000-memory.dmp