Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 23:39
General
-
Target
2b619456f28686f6e8a7626fe7b24a57_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2b619456f28686f6e8a7626fe7b24a57
-
SHA1
64bf0dee2bbe9994547303b29d6725536ccf6b04
-
SHA256
501fed924342c7023015068c2dc4317c7f23a301ac6d62442880dfa0afda68d6
-
SHA512
92a1882ff972e34da28be4e115ab349ae9cf85519266a26def634d0eade600d2fb900dabd494956ab620aa0ec056fc58b07f0bfa509e373888655a1d801a14aa
-
SSDEEP
24576:WuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:W9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b619456f28686f6e8a7626fe7b24a57_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\bVb6N\sigverif.exeC:\Users\Admin\AppData\Local\bVb6N\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\HzfA\iexpress.exeC:\Users\Admin\AppData\Local\HzfA\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\qAdqy8lP\recdisc.exeC:\Users\Admin\AppData\Local\qAdqy8lP\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD595b23fa4a35c5ca5417501e700c4fe42
SHA14a6ca062b3b74d6c1133576fcde8de02d4e30570
SHA25658e2afca29fd78e0c22df4b9e022c595d2d049ab494fb7078c3ea34c94c20d87
SHA512868864b8331840257ebbb289f0d4f12405ecc637bbb6abdef9d1b9c626b7c7a747aaa30156a3cb37032d0107f9bee53ae6d9206c63e4edd1b51d1daee70eeb21
-
Filesize
166KB
MD517b93a43e25d821d01af40ba6babcc8c
SHA197c978d78056d995f751dfef1388d7cce4cc404a
SHA256d070b79fa254c528babb73d607a7a8fd53db89795d751f42fc0a283b61a76fd3
SHA5126b5743b37a3be8ae9ee2ab84e0749c32c60544298a7cce396470aa40bbd13f2e838d5d98159f21d500d20817c51ebce4b1d2f554e3e05f6c7fc97bc9d70ea391
-
Filesize
1.2MB
MD555189a5d2ec91aadbd07a9feddc09b9c
SHA1f79e8eca6826abe1d7afa300cb50e62ca6e45359
SHA256d45e572ca0dc4e3fd3501423b6d848bbfedd1a3f6f68eaf85610b8f2796a4949
SHA5122da248ff0fe19855b9281fa73be546370fcbf4e31c130fae9fc5bfdaca7597df1df49fe4db0a871c232a072e5cba9c91c208969b9a8089dc03f996c39ef9e067
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
1.2MB
MD53dc77b51d7ad0e544681c9e50a934ff3
SHA1f94719cd7379b89520b60b8a25628de8e3048f2d
SHA2564096e22d1b3caa135b0ced5de65852bb6d9a5f8653a9b81dee3a2ac47c7ae85e
SHA512aeb337e5b1ea723a38e9a0b7dc7e2c236a2faf0035de1a211529a00d629957207afcd2ad1c640f24a620eebf5f14314afbbbfc3e548c8ecfd03dbf653c157506
-
Filesize
193KB
MD518afee6824c84bf5115bada75ff0a3e7
SHA1d10f287a7176f57b3b2b315a5310d25b449795aa
SHA2560787b37cf197595b8149ffe3784f9c59eacde3616011f185513ff5c075a5ac4e
SHA512517356165b401dbebf15437d3b17746aef5a6a4cc62a0afe45966abc92b4cf377eee4514a36ee28b1e88e55a22a2f8a6c997df45971e7f354b66ac7d9e141845
-
Filesize
1KB
MD5c215487a434ebe7a5d06dd3c72e26f48
SHA1c9a885d2181bc6014b4213c831506238a1759f6e
SHA256f8abc56f62b180375e6447e00d9f0e0155ab328ac6bcc3cea43cf02c399ed84a
SHA512cae39fe546ba1b7da8d774fd57bf0955e169dcbe03aabf29d32aa1f8f3919949d9943af7308717ef15b69da4fffe8726040bef3f7ae43092aed7f344a3b63287
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB