Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 22:53
General
-
Target
28f9d2567ff022f9487d72b412530ca6_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
28f9d2567ff022f9487d72b412530ca6
-
SHA1
11c59d4f551d171cd7719f68018a5881be91f0dc
-
SHA256
3d91e0a34af694a2c0dcecbf51e9aea69df32acfafa28e778f8136585c188a9b
-
SHA512
6923bdeb098a1e1df22ffc683766fdb5c44b4b2e01acd6b2622886229efa1e1bc601f66426f5447cb16021e4502af31c09f0ea1f57e81c6221fb3d81e32f44d7
-
SSDEEP
24576:WuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:W9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28f9d2567ff022f9487d72b412530ca6_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\shrpubw.exeC:\Windows\system32\shrpubw.exe1⤵
-
C:\Users\Admin\AppData\Local\Q0m\shrpubw.exeC:\Users\Admin\AppData\Local\Q0m\shrpubw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\QpE\wscript.exeC:\Users\Admin\AppData\Local\QpE\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\POQpvlDg\EhStorAuthn.exeC:\Users\Admin\AppData\Local\POQpvlDg\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
1.2MB
MD576cd883ea3f3fbb3758d6a9d34d7a9e1
SHA14aa470f809e3fd28899a9ec50beeb2cffda9fa2a
SHA256c3002d5c580e29381dc60a6310d4a1cc5b6d97967272414c6d27a641a61b1b3e
SHA5120427da0be36b7340d0f52a52ad6b57ac8bd727009d894237467367334060c33e9ee852bb5fdfed2534e33831c6ae4022afdad7656a602895251e540035cba134
-
Filesize
59KB
MD59910d5c62428ec5f92b04abf9428eec9
SHA105f27d7515e8ae1fa3bc974ec65b864ec4c9ac8b
SHA2566b84e6e55d8572d7edf0b6243d00abb651fcb0cddddac8461de5f9bb80035a2e
SHA51201be043f7ff879a683e53962eec58456ba200d6787ea66581bb62669ae65d5e58a5577cdf23441165f7a535fce1dec933e3ad2465c72172b4a1488b24ce722cb
-
Filesize
1.2MB
MD55110301fae3d875cc689d62804b3d0b6
SHA1d5e7fda302055f5c2c32810088df63f5d64ef84c
SHA256dc07da33cb60ce7962309cb235233e619cffc96b12312ab5f0b04ee20104e9c5
SHA512ebf21c81bffae3677eb77d64538168aa6cbe074f9e39f0ceb824c7cf88139099c8c58da4a90afc2875e9fb4091a6d2072f07bb5e3d8918bde7cc4a6eb658f3b7
-
Filesize
1.2MB
MD5b0951acaffa3570e28eeb4df8ff61e7b
SHA1142e94b105eabf123e142ee0b6aad0d36ebe19fe
SHA2566637b644ad510cf3d3cbc1f903cf8fc9b28b17c90f76f5c320add69c353972b9
SHA51235fa2dd061694f8153db00d1c53d4ea1852deebe9febde89132fc066537de09e96ec0f88e5125adcd0ac1af90b5ff965f82398def02e086fe4a092ba4e7dd5d9
-
Filesize
166KB
MD5a47cbe969ea935bdd3ab568bb126bc80
SHA115f2facfd05daf46d2c63912916bf2887cebd98a
SHA25634008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
SHA512f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
-
Filesize
1KB
MD55e81bf47f3af6f494a3556644e8d766c
SHA1c311d85e94ab1b3c073b725bb3b07d9fa13e920e
SHA25680a696797d4b9da666611f6d0c265852f2128f10cd350ad47552cacc4f4d3003
SHA51237da2d1a8dc40976031766ae86e4f7796b6d1b7dab63eff75db3acc08e8a1d2044ec92859315069c47be5da06c266231b52a2c4a0005cfd114c836b739a21a6d
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB