Analysis
- max time kernel
149s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
28/05/2024, 23:41
General
- Target 7ecdae8ff4ce7a29e1cc131d4ff098b0_JaffaCakes118.dll
- Size 1.2MB
- Sample240528-3pht7aad38
- SHA256 f85f26d71c527e7078122cfaee013e2881573630fdcfc8dcde64a24698824105
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ecdae8ff4ce7a29e1cc131d4ff098b0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\7G42t\raserver.exeC:\Users\Admin\AppData\Local\7G42t\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\1YWfOA7TK\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\1YWfOA7TK\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\nArMXYZj\eudcedit.exeC:\Users\Admin\AppData\Local\nArMXYZj\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DevicePairingWizard.exe
MFC42u.dll
WTSAPI32.dll
raserver.exe
MFC42u.dll
eudcedit.exe
Lyvwlrjkvg.lnk
memory/1872-85-0x0000000140000000-0x0000000140149000-memory.dmp
memory/1872-82-0x0000025BF9560000-0x0000025BF9567000-memory.dmp
memory/1964-68-0x0000000140000000-0x0000000140149000-memory.dmp
memory/1964-63-0x0000000140000000-0x0000000140149000-memory.dmp
memory/1964-62-0x000001F7D5610000-0x000001F7D5617000-memory.dmp
memory/3540-35-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-29-0x0000000007130000-0x0000000007137000-memory.dmp
memory/3540-10-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-8-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-15-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-6-0x00007FFC27C0A000-0x00007FFC27C0B000-memory.dmp
memory/3540-12-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-13-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-4-0x0000000007160000-0x0000000007161000-memory.dmp
memory/3540-9-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-7-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-11-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-30-0x00007FFC28E50000-0x00007FFC28E60000-memory.dmp
memory/3540-14-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3540-24-0x0000000140000000-0x0000000140142000-memory.dmp
memory/3720-51-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3720-45-0x0000000140000000-0x0000000140143000-memory.dmp
memory/3720-48-0x00000207CD010000-0x00000207CD017000-memory.dmp
memory/4876-1-0x0000000140000000-0x0000000140142000-memory.dmp
memory/4876-38-0x0000000140000000-0x0000000140142000-memory.dmp
memory/4876-3-0x0000028CA45D0000-0x0000028CA45D7000-memory.dmp