Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12/05/2024, 07:51
General
-
Target
390a10d9dd8696c4e65bccab37765595_JaffaCakes118.dll
-
Size
1012KB
-
MD5
390a10d9dd8696c4e65bccab37765595
-
SHA1
ea431bf6ae141df4983d8085f76d96df8dbbf3c6
-
SHA256
8eca4d43a12f1fd21b5f43dbd6db31229c7e4eddbb21c3f1492ac0af27a27268
-
SHA512
b65bca41907ec81c3840bcad087c1bdb11bec6a1498d3be8d6331a9af785a9e6836b8adbb57789c6f856f6d92fedb1422411d2e55d71a3344cb8832917d26b7e
-
SSDEEP
24576:lVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:lV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\390a10d9dd8696c4e65bccab37765595_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\mEzcw0f\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\mEzcw0f\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\5cxGFB\GamePanel.exeC:\Users\Admin\AppData\Local\5cxGFB\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\jlQvE5\PresentationSettings.exeC:\Users\Admin\AppData\Local\jlQvE5\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
1014KB
MD5edb7d76bd39780aec3f1d8942f73577a
SHA1046e40a0f50618bac0a71f4ca379eaced94f6218
SHA256db82c1839f736b86efb5c6b91de96434b3755c88ac8eae037493a8f370d51680
SHA5127c857ae40718c19868f76c6691245412ecc9595f89be127a6b89221ef264c3a862dc8d58b4363f196404b8a16163772a688604399244f7282f9e18ea79495b84
-
Filesize
219KB
MD5790799a168c41689849310f6c15f98fa
SHA1a5d213fc1c71a56de9441b2e35411d83770c01ec
SHA2566e59ab1a0b4ac177dc3397a54afcf68fcea3c1ee72c33bd08c89f04a6dac64b8
SHA5128153b79d4681f21ade7afe995841c386bff8e491ad347f8e7c287df5f9053cae7458e273339146d9a920ceaa2ba0f41cc793d7b2c0fa80efbb41477d39470866
-
Filesize
1017KB
MD51ffc746118bfc943604b9d7642591380
SHA15c6caaa572c5ab1c45626d336c0559bdd8e9fb27
SHA256e66bd86bd0f50088fec4abcd7618b1ed613973730e432c9bd86842c789856bae
SHA512ec1d2a4851df22a35ea52ada9d770ee310de3bc4f68a7e61632116a6c490db03f9b34d9546c1c2b1b0f6b0f94ca0a5e56175c50d15177a37aff4bd58063f9c38
-
Filesize
1013KB
MD520474abaa311caeede5e404057bc8833
SHA1fb8c885195c697d08bdcf8bd7691c5464b8fc778
SHA256a67de495f6cdf2e70aa6e90461c4651e2b09e5d5bef6eaad5124cfa8a87c917e
SHA512d0575a6c36a599daa5237a46274a9d74a83ede915d563f67db914dfff6d742724316eb628cfa8fa402368f1d9254afec54d29a6c3c203b0bc384d0c828b504a9
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
1KB
MD591d9ce193c87a404c072669acefff4a5
SHA1b8fae3c66279b31ffb739c3b5bcd534df184850d
SHA2569fd3bd142056c9c14cc46c12f33e0f98d95bd90488bafc5db1dda117d41af656
SHA512720c0ee46d8831ccf36d7f4c328a325cc83041b7245abcbd790ab79d338760076e02252c810de1d5467b58683f9fa4a5ac72ae38202aa652a4c22e9f25923cc0
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB