Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
25-05-2024 15:12
General
-
Target
72608747a45a7319e8a366c80c12b5f1_JaffaCakes118.dll
-
Size
992KB
-
MD5
72608747a45a7319e8a366c80c12b5f1
-
SHA1
211042d8e9ba7565645574feaef38139f279b517
-
SHA256
46c447cd6bab5cf7dc2a900f657f9c7757b531ebe05e186f7d0770f8f8319e3c
-
SHA512
13147d62893262189621788d4de4ed4b35ff2b9e5e2f36bfcd46aa8b0f4ff3eb78b1637d0028398a0b80c1b8ef816f832d9bc6cf445986b1ff243c7ab100d2e4
-
SSDEEP
24576:NVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:NV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72608747a45a7319e8a366c80c12b5f1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\XFvRbC\isoburn.exeC:\Users\Admin\AppData\Local\XFvRbC\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\wBo\Utilman.exeC:\Users\Admin\AppData\Local\wBo\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\1PWR5\isoburn.exeC:\Users\Admin\AppData\Local\1PWR5\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
995KB
MD5cd997e8740aa6c7ffaaad3889da430db
SHA1ce4675e1569ae12b293ddf770d6aaa35c3e2af4b
SHA256cf7edca9f2a91785f03d51df0332929b09d6e5b6e8bb8707031d5db3660640df
SHA5120e8e4449de561fa5eed84be5ce61dc822c6efccdb2a4b5b2b95675d38efb317da0713ec434fb8351cf27034e7ca44d72d89ff23ea09cebbad6949551a7d5c71e
-
Filesize
995KB
MD581181d3a04d12c2bc8f6407a130a5a91
SHA1c7538c69d1b9d15253fe80b08418af1e121c1697
SHA256767a540c060632e1d1e5619e2636d46a0523e88718393272457a93d01bae17ee
SHA512216d6c2380ebfdb9b95acf2f4a1736f64744003e775a01a6bfe430ed36da936f311412b0f328a46e45074f10893f6563e99852056c2ab273dc059d166ab4f2c3
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
996KB
MD51c289951ec0c1574b1c1701f026e5ec7
SHA135c1d615d1b8d36b116476fe2eec7fe4861436c3
SHA25699c0f3f0461ca055ad46a2179b156569418b3a6b32bbd31ed864fd609931a182
SHA512990efdd2fb03897f100a621a4a6e569d0a4eb53d5b10a78f308c434bf5397bb0bb8e57b146c58175648aabd0e248805e6d7095c944c6638ab83200b4fb68a36d
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
1KB
MD5a6dea3d6a92265705d31fbd7fb6b9667
SHA1e57820c4c6df72fd04fa0b5ba72aac67c50d50ca
SHA256777c07ddedae2e9e419a5be84e32478b6f1dda7d3bac0c3c3d898f792f99dffc
SHA512f33a0ef5e9312c63759fc20216606ba2a9bac31a640c1a960023ed3399d8b8567ce4906a041eaac6e8aa999cc7d672ac8457fe106cdd7c2d2c6bcd8ae2736107
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
64KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
1012KB