Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
25-07-2024 11:58
General
-
Target
6f7a623c394f68d9d01256a739dc60b8_JaffaCakes118.dll
-
Size
816KB
-
MD5
6f7a623c394f68d9d01256a739dc60b8
-
SHA1
80236913566d2427f3f39e866340434ba501726b
-
SHA256
bb2072b180f158e3c9473af4d94abe6989741d81f72861e4230c35ca2cb04b04
-
SHA512
fbc4702c4005335ab90a6f038d92947050d5626c5560b40ce6bfc07bc1ccd9fe7927879de97717a294349124a37517f4f22850ffb82f42479aedb1eeb56d38e5
-
SSDEEP
12288:zdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:BMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7a623c394f68d9d01256a739dc60b8_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\GBt\omadmclient.exeC:\Users\Admin\AppData\Local\GBt\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\Cqi1g\ie4uinit.exeC:\Users\Admin\AppData\Local\Cqi1g\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\systemreset.exeC:\Windows\system32\systemreset.exe1⤵
-
C:\Users\Admin\AppData\Local\Eb7b\systemreset.exeC:\Users\Admin\AppData\Local\Eb7b\systemreset.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD5d74a35e904bbeb5c691077573b526047
SHA14c7b2ea66baf43e4b01e61ce2ab401c8194623fb
SHA2566a4f70a767972a787a1f0fb017d2dc60ee16d4f953094b9dcd43570ae25aa680
SHA512086c9e052fb62e879fd22abb8478522fbe1a3f0c411fa13de34530a0f865c28d772740afeefb93fde5f97b4d69bd00c5e144ccfb091ed45140fd98846c3dff9d
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1.1MB
MD50d272adca3eceb60b83b81e2f23c578d
SHA1d327d8a3f98a3fe439d3bccd386c3907d3dfa2a3
SHA256442c8d41dd05eebc5cb20479a07ff5225cc738d8ac71ffe8ff2ae85ef468b467
SHA5126f91aeb8ff7fbbac116b270d159a0aeb04c2924d0b3182a7bb96c9466ebe5c097f20d892cd1f6d3d7b7d48f894660b54e1b7a3a57bbbb99dc3c9af241f023dba
-
Filesize
508KB
MD5325ff647506adb89514defdd1c372194
SHA184234ff97d6ddc8a4ea21303ea842aa76a74e0ea
SHA256ebff6159a7627234f94f606afa2e55e98e1548fd197d22779a5fcff24aa477ad
SHA5128a9758f4af0264be08d684125827ef11efe651138059f6b463c52476f8a8e1bed94d093042f85893cb3e37c5f3ba7b55c6ce9394595001e661bccbc578da3868
-
Filesize
820KB
MD527942e520cbe63851928aaddbf2fda5e
SHA118acb6aff6ce4d38db0bf915836e595604d16195
SHA2561091968093deaab610532c3e0aaed71733f65997d8da0e93e4fb389e82a5b024
SHA5123bf526b5cedaeb9789f84cc00364afec269812b4cb17dd24e20e3e5b498ff4ac9ea7a950dff0f3d3bfa3903980f41c3c3de3f3b0335abed6579b5122fb24b20d
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
1KB
MD53317085d556f23942cb075bb04ca63f0
SHA1b3307f9f89e5e4160593c4983afc1de8a7f2e84a
SHA256be0137b442b6f7d78dd59a9ba0e29aed7ecc184aa4a9c1e25a2338f47c22493e
SHA512e8dfb911ac3a20c5ed0cdae6ffd026f1490bd387d7d16b805dcbcbb1287992eb2463c6eade6d43eaac7dedf160ec0eadd3b64a337e46b65c9e607d16b32d58f7
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
816KB
-
Filesize
28KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
28KB
-
Filesize
820KB
-
Filesize
28KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
28KB
-
Filesize
820KB