Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240729-en -
resource tags
-
submitted
28-07-2024 02:32
General
-
Target
060a84bec4029d28ef32d2da09fb89f0_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
060a84bec4029d28ef32d2da09fb89f0
-
SHA1
01e4f103c7a644f11551433cd78daacb6fa120f2
-
SHA256
a6db43ae471602cfbfd5321b0536f3afcc8b0314e54768fa4f593303193a7337
-
SHA512
3e558efe6d582d27f042bcdda3b63c5075217a4cc1107474686c08fdac08d673c168bd61c1effe81e90d66401d3f5b75a15e61bb26a6af5fad4fc88d26ef1b0d
-
SSDEEP
24576:zuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:99cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\060a84bec4029d28ef32d2da09fb89f0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\TIjb4TI\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\TIjb4TI\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\0FoKtCZg\wermgr.exeC:\Users\Admin\AppData\Local\0FoKtCZg\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\nEB63\msinfo32.exeC:\Users\Admin\AppData\Local\nEB63\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\tBUjBI\cmstp.exeC:\Users\Admin\AppData\Local\tBUjBI\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5f7991343cf02ed92cb59f394e8b89f1f
SHA1573ad9af63a6a0ab9b209ece518fd582b54cfef5
SHA2561c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc
SHA512fa3cf314100f5340c7d0f6a70632a308fcadb4b48785753310a053a510169979a89637b8b4fedf4d3690db6b8b55146e323cad70d704c4e2ede4edff5284237d
-
Filesize
44KB
MD5591a98c65f624c52882c2b238d6cd4c4
SHA1c960d08c19d777069cf265dcc281807fbd8502d7
SHA2565e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA5121999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074
-
Filesize
1.2MB
MD5d559b549d067383178646e021c6d1dc3
SHA15ce2906026ba679827d19d45c78c21a5dfa55026
SHA256502f45a05caa5c6e0fa1e0d40d206c73e00ab1f39264289b11581f68ed7505f0
SHA51295e0d7900de4c592e32acbc139fb921846b7a90ff36e7d2e9f6d79752b4003d81f6517e3cddb49a888fc041527762cd50bf95c862f169a40ddee16f12bdd67ef
-
Filesize
1.2MB
MD5d0c360525546b5f0e089c986c783f72a
SHA1b146533018e87bce3f4fe4e93644086f52527dc2
SHA256a9ca5a28bc9c67dd7848024b32a7200730ed08a670412fb3ac29bd015f4f74d6
SHA512b945acf753ef2bdb30ccb8a4addd2bd9d769527d7d054c0a8733e57de8728015e6d7c87adcce4de28e40074cdae9298add7433668897ef58a814e3b5c566e858
-
Filesize
376KB
MD50aed91da63713bf9f881b03a604a1c9d
SHA1b1b2d292cb1a4c13dc243b5eab13afb316a28b9a
SHA2565cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14
SHA51204bca9b321d702122b6e72c2ad15b7cd98924e5dfc3b8dd0e907ea28fd7826d3f72b98c67242b6698594df648d3c2b6b0952bb52a2363b687bbe44a66e830c03
-
Filesize
1.2MB
MD5d08c960b434e46ba5240ccac7c5308dd
SHA193ccd1264d81c6e44a9d92216cf3867f957f9d62
SHA256fc6462337af4a9edd608d632b03ce06b9e5ef53fdbc7754b60b795b30398bff7
SHA5127c91d5dcfe4f0bf35b4256819089becdc3a89dd92fb05488ac5b1a38fa487c1f804b66ff87a1f5fab823e6783c1cefd428e4625349bfa738747244791ef99890
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1KB
MD5e19e5bc2e6506dbc5e64fd590866277f
SHA17c9bc588168a4afc78d710bf54b6e1168b2abcf3
SHA25662bbd04ad191ebb98a345044693cea6232bc8ce9c2168517c6b04f14dbf962ee
SHA51227948d8852d5bff2d2cbb19f02054f8304954f130cea43813edfe8690e8055342ca6ccaf44695498208a8b9acb65b433741a610d53d2ad675a63af718cb30fa4
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB