Analysis
- max time kernel
102s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
21/04/2024, 10:33
General
- Target ff148ec8e1536ee937ede7b13205c52d_JaffaCakes118.dll
- Size 1.7MB
- Sample240421-mlqsmagh69
- SHA256 fa1fffa330bfe6478d3a53ffa67b6e24acb51f3f99582a740dca8593c0afc5b7
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff148ec8e1536ee937ede7b13205c52d_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\q4Yj2LeT\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\q4Yj2LeT\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\Nw8OxAk\rdpclip.exeC:\Users\Admin\AppData\Local\Nw8OxAk\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SnippingTool.exeC:\Windows\system32\SnippingTool.exe1⤵
-
C:\Users\Admin\AppData\Local\EGKC6h\SnippingTool.exeC:\Users\Admin\AppData\Local\EGKC6h\SnippingTool.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SnippingTool.exe
dwmapi.dll
WTSAPI32.dll
rdpclip.exe
SYSDM.CPL
SystemPropertiesPerformance.exe
Axoeay.lnk
memory/2648-0-0x0000026B957A0000-0x0000026B957A7000-memory.dmp
memory/2648-1-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/2648-38-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-27-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-30-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-10-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-11-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-12-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-13-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-14-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-16-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-15-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-17-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-18-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-19-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-20-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-21-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-22-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-24-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-25-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-23-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-8-0x00007FFFC314A000-0x00007FFFC314B000-memory.dmp
memory/3240-28-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-29-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-26-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-31-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-32-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-33-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-9-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-35-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-34-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-37-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-39-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-36-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-40-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-41-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-42-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-44-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-43-0x0000000000D20000-0x0000000000D27000-memory.dmp
memory/3240-51-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-52-0x00007FFFC4C60000-0x00007FFFC4C70000-memory.dmp
memory/3240-61-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-63-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-4-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/3240-6-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/3240-7-0x0000000140000000-0x00000001401BB000-memory.dmp
memory/4072-78-0x0000000140000000-0x00000001401BC000-memory.dmp
memory/4072-72-0x000001B286A90000-0x000001B286A97000-memory.dmp
memory/4072-73-0x0000000140000000-0x00000001401BC000-memory.dmp
memory/4080-90-0x0000023020580000-0x0000023020587000-memory.dmp
memory/4080-95-0x0000000140000000-0x00000001401BC000-memory.dmp
memory/4808-107-0x000002DB21FA0000-0x000002DB21FA7000-memory.dmp