Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 07:47
General
-
Target
0f3c2af0c1a23bc40eec9f73f691c054_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
0f3c2af0c1a23bc40eec9f73f691c054
-
SHA1
9b81c96e11542a05ce7b7e57aae15bc5b9aae3e8
-
SHA256
cf8cfd47e22b61c794f94665ca10aebc9466050a3cedc6489305079f9d1a8e42
-
SHA512
ae1a29dcff7326980b73de0419620ba7fdeba01a5271687145635a22d5c4aaeb3c62a30263a32a5fd2bbee15088544da443d4045fd71fc58a3e95b0afd39f6d7
-
SSDEEP
24576:WuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:W9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f3c2af0c1a23bc40eec9f73f691c054_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\quickassist.exeC:\Windows\system32\quickassist.exe1⤵
-
C:\Users\Admin\AppData\Local\D0O\quickassist.exeC:\Users\Admin\AppData\Local\D0O\quickassist.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\luhcKU\rdpclip.exeC:\Users\Admin\AppData\Local\luhcKU\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\hhuyLu\msconfig.exeC:\Users\Admin\AppData\Local\hhuyLu\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b36789bd1fc85fd286ff5ce5c8182b8b
SHA14d41e603ba960e261d0fb8be8c4caaf27ef50b5b
SHA2567a6ffebee75a92174120f129b31b52b09b3d3ee89f21dcc4adcdcca9ec82d19f
SHA512a704094e0c72868e13e821f1263a6713076193f33bb0add0f403fa2456d008793b9e78f49c555a1fb148b67d8f745bab9ddd3de2a7cc5a82453231668114f822
-
Filesize
665KB
MD5d1216f9b9a64fd943539cc2b0ddfa439
SHA16fad9aeb7780bdfd88a9a5a73b35b3e843605e6c
SHA256c1e8fda00da574e8759ba262d76b6edc1d5f4a80620730ef0be7527e0d803db2
SHA512c5fd7d81d1d478056fcbed0ba887ce551832f0104e7c31753c3c8760b4d63f38324f74e996684042acc8f9682fce8a8c85172741a868257e87d5e0f988c4e567
-
Filesize
1.2MB
MD51dffc253b2480eb13347ab2584d275c4
SHA14fffdd3eda7936d3e603a516268b23657607db4c
SHA256e225bfdaafb14b1cabab79b1d2240e15b170efafe28d00d724c4a7ebdf3e3b09
SHA51244a9b770af4846f1f69925769c98b42f8746ab3c6b5fa5d8beeda3fcaa901d224ac491cff1f0247aaa830724e5559f3c8d0aeb1892aaef904a980a90e1b6559a
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
1.2MB
MD550ab62937549c8ee9b9a637f8039ab91
SHA1778301f3edc6aaccac083075252c693d40899658
SHA2567bc53b9eb55fffb2333c092b7d8ef989ead2da63cc3fb4d3712cbca74149be3b
SHA5128a7bd2c46544dfae7a4881221774254031b790e5cdf2a692ec9c93300ca4d90c64ffc1fab0fd858367ddd5567aa5eb20f90c4c5f268c9bf639362fc9b84ba6a9
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
1KB
MD505a7ad7d3374b51806942689fce6490b
SHA18c64226883f19027ab950643f7aeb75524d0d5a6
SHA256c6b66b3add130cbb06dd2d8c4bddd486721104035ccc7932e63c1cf6041838ab
SHA5120f1f1e5ec88d4cbac5824bcaea6ed1715c0a7b87a173e874d510ac5a45eea2c00e4f30d653f5e2121db2d2e2c51b5766271382b9a3f8f566c1bddd8defa971b8
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB