Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
18/07/2024, 04:53
General
-
Target
563694b5b3e24156272e80505a060dfb_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
563694b5b3e24156272e80505a060dfb
-
SHA1
e95033c6a1c1a711134aedc993f56b953cd86efb
-
SHA256
692edebbe453068bc42b4ca091ef8eaf27c544777b71b2f17930bde34cd67698
-
SHA512
7fe4a9bb7d9ed79a7aba262c0bbb664ff2c6685a61ef8810f7b30fe17a888c44adfa2427c896087d567511098745c1e876f4f326024e9302248f9df83c0dba6a
-
SSDEEP
12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\563694b5b3e24156272e80505a060dfb_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\8up\perfmon.exeC:\Users\Admin\AppData\Local\8up\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\RvFD\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\RvFD\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\f4WcRte2C\EhStorAuthn.exeC:\Users\Admin\AppData\Local\f4WcRte2C\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD57f1e8de85f7d7116ccb1e461fe7f2f85
SHA19675734c6c9d924a593c3b83d41f2b8d0997755f
SHA25648d5f0af6a42bbc6d576068033e855f8c81583d8466719139d6abb654111cc84
SHA512e706c34f55da3f2a999a92f02ba008c9800cc4b4be6abd0c6e63b59d3ea84c45b6da2c66ff89a0f11898b62078e688915641b79f73756fb70c66217b173cdcef
-
Filesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.5MB
MD5ea8899bc4eb70c2053137fa1038e5336
SHA1e2b9b512fa6439342405ff186bfd469a1bc58898
SHA256fd232ac68401db20ed1da991b575695da80ab6449997baebdf0a1c2ad5beb6c3
SHA5122f85f7a20c31e01954056e8d6ec804a50baa23f4209e843dde4135d7a4c98f6202dd7b795435c2e06b39e5253d2a78f58b1fd3b66ec03ac8ecfe12f2b4ef544c
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
1.2MB
MD55af1ab71c6b5836db7d45ccf6de06411
SHA1e125ac7141267f568f88443817f112557992094a
SHA2569ac6f80634d22e14af3928f9bef4ce14a959a1a9ec52881bc299ee76fc5fa131
SHA51202d786d81ec0b98a1d25ce39b2750e4d5d448314022954911ad76ae9a6f11d40f8bf8ee22a20ecda30944c45deac8f992e570370f2157420a263b15ede96160e
-
Filesize
1KB
MD5c9cb56b6e6ddf9eda3335130b5dffe29
SHA1087cae6639dad20849c5275ae896612b29cbb644
SHA256a477c210bbc2084f14a59951540fd688b6796fbfd793dda8320a2625758e0342
SHA512aea78ed57496cc82f687ada3c3520271faea71c6aeaa0ff413128714ab48ad2671dd039efdf325638969107c5ce1d49066793468b63a9c807b3ca3cb86248cc9
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB