Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 09:33
General
-
Target
f579600a6574f3180a38366e521e062d_JaffaCakes118.dll
-
Size
1.5MB
-
MD5
f579600a6574f3180a38366e521e062d
-
SHA1
cc123d182933a36f5989fc689bc537f9bf7f89c2
-
SHA256
bf69701383654649697c0a1b2ff900751ffd006daad2d58b688913fcf360f5a7
-
SHA512
51bf19b830c2a7254f9b75ea1fb81d89924f24bc111fe69eeedfdcca716bcf13599849bc4db933b2a79d79f26a24064f8368e0f79af1448294fd9f93fb40c910
-
SSDEEP
12288:ZVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:YfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f579600a6574f3180a38366e521e062d_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WMPDMC.exeC:\Windows\system32\WMPDMC.exe1⤵
-
C:\Users\Admin\AppData\Local\N0db\WMPDMC.exeC:\Users\Admin\AppData\Local\N0db\WMPDMC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\eVO\msconfig.exeC:\Users\Admin\AppData\Local\eVO\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Narrator.exeC:\Windows\system32\Narrator.exe1⤵
-
C:\Users\Admin\AppData\Local\SIvsx\Narrator.exeC:\Users\Admin\AppData\Local\SIvsx\Narrator.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\aS8VYyp\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\aS8VYyp\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD559ce6e554da0a622febce19eb61c4d34
SHA1176a4a410cb97b3d4361d2aea0edbf17e15d04c7
SHA256c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba
SHA512e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18
-
Filesize
1.5MB
MD5fb2d27c2980af17a4f1a5867b2c31314
SHA1791eee078245d8f8d4295d8115232af3a8aa0a13
SHA2563c52e2821eb91940a3b03cd44c30bbade790382afde50f0afe7dbfbea326f5ce
SHA51269cc9858f17eada71e5f44818ab2a4871393fed01075e6433b04f3152ddde2ed09286a0966502c61bd7fa492f65def81722a713818a4de8917856b03e789e547
-
Filesize
521KB
MD5d92defaa4d346278480d2780325d8d18
SHA16494d55b2e5064ffe8add579edfcd13c3e69fffe
SHA25669b8c93d9b262b36e2bdc223cc0d6e312cc471b49d7cc36befbba1f863a05d83
SHA512b82c0fbc07361e4ad6e4ab171e55e1e41e9312ba995dce90696ca90f734f5d1ea11371ca046e8680ea566a1c2e0643ab86f1f6dcf6cbd05aed8448425a2830b5
-
Filesize
1.5MB
MD5c9a924f747fcc06161cb89e2a253dcd6
SHA1547e72339637ea5b05ac47707dabff89e0cc3e6b
SHA2569ce821dde76e7e9bc99aa964daeb14a5374420d1a9383c1796a4939b9fcbb8d5
SHA5124cad1acc8d494b7131a1ed82fcec403beb11d462fd8f4f252b2a1a5257430a8178b035afccb6d8c1dca0dbcde70bb8becce4d7e54e92200df795a9a86ec40d58
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
1.5MB
MD5243c617ecb339fe1bf536c2b70bfd546
SHA1faeea50585b2e040af75fa739a99b5057831c50a
SHA2567f4173bb22218b45a76711b81d29eb841f4f0996ea47b306144fe9d223754fa9
SHA512e5ab2faeb38646709e29b9c5564b35e2f0662faeac58a8cf61ac855c367446c221ff2af68b7280b077be2b49078ae646d3405af125e4133d6f88d04a8811236e
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
1KB
MD5ef56cad5851a39022fc5c10851cad454
SHA10e853a62da8c0c4eb639df771d73e8ecf11e8306
SHA2565ed18a2c49d745b05c2c507a3664926f7a62db13005cd984049f140dbde3fcbd
SHA5126bb5019a4585031cf2d7414dfb9aa8edfe0226b7f3d1041c97e67072094a2bd40a5523311708713533c6f318f92338acc01541fbb19882f2bd7d3f1efd02e15e
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB