Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 23:52
General
-
Target
2c083f8ebf66a7c0ead55769be9f6585_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2c083f8ebf66a7c0ead55769be9f6585
-
SHA1
cefc2e8de8b5d48136afb11147374028cac9cddb
-
SHA256
33dc43b0e4574bbc29a2f77c51fd830184c8b3c2f9ae34c4b9a762e44b8b5b82
-
SHA512
b3a9c52ca44616593d8a6c72bde20962a20ee71ae0f5c9c886d797d89c5f3dc7d9834865cf829dac10f00dad867d69c8369755fdccaa14d8b8df698dd7963f5b
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c083f8ebf66a7c0ead55769be9f6585_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\95pX\MusNotificationUx.exeC:\Users\Admin\AppData\Local\95pX\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\hPCm85\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\hPCm85\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Users\Admin\AppData\Local\6IIZAJ1H7\printfilterpipelinesvc.exeC:\Users\Admin\AppData\Local\6IIZAJ1H7\printfilterpipelinesvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD554416c0ff1109d6ef85832c02ee85ae6
SHA1d99d2d602b7a09814b834c57f6fd0f064a2dac45
SHA256a362944ff20c773122ddba5f34354ddc644cc16ea2d534d28ed555c40831f13f
SHA5122abcbdd643eff4c1bcc600e5734957eb47cd11580b4e3c1f987f1d341a9c803f2f2d882d46af40eaf42b413f0b882784bf33fba1994928357279c23ba42e8c62
-
Filesize
813KB
MD5331a40eabaa5870e316b401bd81c4861
SHA1ddff65771ca30142172c0d91d5bfff4eb1b12b73
SHA256105099819555ed87ef3dab70a2eaf2cb61076f453266cec57ffccb8f4c00df88
SHA51229992dbf10f327d77865af5e6ebbe66b937a5b4ad04c68cafbf4e6adbd6c6532c8a82ac7e638d97c1f053353a7c8a6d7e379f389af15443c94a1e8f9b16be5f8
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.2MB
MD5557dfa5470924c21e4683ea89084d193
SHA11592093de0cc30ac5fc84339dd49ba9485ada8bc
SHA2567e07f0b8678a2b26cee90dfacc98b5ed98ac836bdd68a9eed8a173564ea97b6c
SHA512b9ad1c87f304394cfddaa2809edeaa8a357765e9094de88cb0aa93f7f21010f1e32036bb5f044f60b8135fa8029ee5faf7f4b13b1974110b6e390033e642fb7a
-
Filesize
1.2MB
MD5d4da42b2a2206b491b6c3b249cf50e48
SHA1ed70e714cc9fee2182e922baeb6e0dcad2adeade
SHA256ab729014f4a1033297ea5e223178a9f8200630ea34374e2b176515f790b81db0
SHA512acb67c76a5500f5eca89740558474077b0b34e6bbb1533a4bb871495b80bb8ac45a73498f0e02cbac85e79c7a6c4577e29aa82e9b9d1762bbc85cbbcfae2cd41
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
1KB
MD58784ac5fccdf0f1393c12cc4c80e23bc
SHA11372fd8393bd5f08aa06142b03389ee3150e5349
SHA2561e710f7e99004d704a088843fbce661f2f482dae4707f00bc976ed1afa5e3736
SHA5129f3c0d23d539d1cb5ee35478c3ec102115760b488445abcbe1bcced3ab89706988a8cf74df7a913062fb6f0d3a1f1a084344081e170709f2820db3b7f30ce7a7
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB