Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
28-07-2024 03:38
General
-
Target
07a9c9069fed354bde90b7a3483fe350_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
07a9c9069fed354bde90b7a3483fe350
-
SHA1
859af6f560ebc2bf44d5c61c517dfa89141c924b
-
SHA256
7e33cdea0bbc985977bc213b140f31ca542a35ed3d3b2f7d69bf52d691776039
-
SHA512
5cb95b1b195b0594f34c1736036498457ad1eb2ee772d415dc14461ed92c0dfb801e012da9a4f758085e5cdbe1cc8c89f20aa6ed4c5147b3fd2384de013be885
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07a9c9069fed354bde90b7a3483fe350_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\VA1SVLZ\sigverif.exeC:\Users\Admin\AppData\Local\VA1SVLZ\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\ksutV\Dxpserver.exeC:\Users\Admin\AppData\Local\ksutV\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\hDxBmkr\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\hDxBmkr\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5510518a688f22c9d8a968183bcb6937a
SHA1b99cc6ca104e97b503b1b3dbe3025fc652f46a14
SHA256b3998448ec43ed0623bf8f64017a87179aa65cf95902c9001740facf009f5b78
SHA512fee200b78ed4850e8b8914671afaf1b76619eff9c8c29b036b20fd97a49074031730ab9059e68bfa3e47de7ecec48dfc1685ae0af4bf8cd0968b228f297c838a
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
44KB
MD5591a98c65f624c52882c2b238d6cd4c4
SHA1c960d08c19d777069cf265dcc281807fbd8502d7
SHA2565e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA5121999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074
-
Filesize
1.2MB
MD517034163021c1f3089163bb082dd2709
SHA1fe573916f584774a242f36d05045ab2d3d6fdca1
SHA2565f7e5e7866edf7a11ac52f86d8f9b078bef6b7de0b5ae6c2b69c3e30f8c72fba
SHA512bf8459863911a18aa3381d194a1a053fac44c27efc14cd936554fdb621515ed466a1ea52b71a4c82a743d2496fcec7c70ef5beed546385acc9c8e694b331f535
-
Filesize
310KB
MD56344f1a7d50da5732c960e243c672165
SHA1b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA51273f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65
-
Filesize
1.2MB
MD5eaa84f6bcce9492e021cee2355834dad
SHA12d48bc079a8c9acb6648af9def05099ae3818c20
SHA25666ac7c1a1058fe79db61b8755772e77babf6258326b40dbc19496369864c0111
SHA512580a32e1e7f50d0bf38976e0417a5a34bd6f962423049cd0c0c4fc6223c833c5fa1f802d486c48d2e52365e5e35fd3a147ccb04a503f4f2b43c77684f9d6a57d
-
Filesize
1KB
MD5ebc3c6869ecd4c3c129107f979f5f4ee
SHA134da365c983a5af2c9610b1659a2765a5e6b66c1
SHA256c043a2163e675ef089247890b105bafd01a556972085d32a0dfc2f9e1e10ed31
SHA5122d2e5b163d0bb72881eae496fc536931b01195a9a356ec88c334905f2ff1cb0b55efe10ef2f404f322bd40a6be927f327ae3036be76a0168c34b1d8d3332d5e0
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB