Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 10:29
General
-
Target
14bd37f5d3223dc8f0020dbbadbb42b7_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
14bd37f5d3223dc8f0020dbbadbb42b7
-
SHA1
5a2c292ed148afccce224275633d56e602cc458a
-
SHA256
9da5bd994dc18b71c846a1f0b17dcd2c12e40210966e5d8ea4b7fa22b2da8cb1
-
SHA512
b8d3dd1404cf153dc70ff13c4a308e288997991df2912e1261c69c006ab4d63143989922366d20eed846482de5d6a6209b6b3b2fe25e7ab3cdce85b48c406282
-
SSDEEP
24576:CuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:K9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\14bd37f5d3223dc8f0020dbbadbb42b7_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\GUXwv\tabcal.exeC:\Users\Admin\AppData\Local\GUXwv\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\wAxl9md\msdt.exeC:\Users\Admin\AppData\Local\wAxl9md\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\oN72Ffsj\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\oN72Ffsj\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5822c39bad244dac51a68745e0d084af2
SHA104e26d4470dfb85a2b44a613c4a5a7427ba99a2c
SHA25666ddfb58f48fbd31f8b92b98f4a7dde6e08ed95ea36625511fca30eb03b53d03
SHA512c2c62525cbe59f3844bd700c31cf1747e26065faebdddcb6f2d9da42e997fce295a5bee1023fff51e51c063ab9122f9309de80d8a11c03ce9945364adfa87086
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
1.2MB
MD5285589d8652ad73557c5cdf4fd8705a7
SHA19a8609291464bd8fe8914c67d828fa6533f744b7
SHA256ffece3dbe86534cba97e56c97d5ebaef6b9eacb10a032814b53f85efa27d1cb6
SHA512349ba59964ecf3bca510af8a665d4185c6f55ff07a81e58447f405ea889ddacca8bf580e8d1534a4e2e621ecc1024a72b81bbb5bacebee38ae436c0aafa1c5bb
-
Filesize
82KB
MD5e4fbf7cab8669c7c9cef92205d2f2ffc
SHA1adbfa782b7998720fa85678cc85863b961975e28
SHA256b266318d45a4245556a2e39b763f2f11eca780969105f6f103e53dd0a492bb30
SHA512c5c62578d04133352d6cb7b018df96a7b55c18d6111ab8bf2bfe232a3315a63b07047fa5b0b88551d152085776c66169b47566242c8c4c5e0333c55adc64e1b6
-
Filesize
1.2MB
MD5cf0f68e5a30cfd46efa451108677db1f
SHA148d0dc6962123bdb995d721957733aa560c08e4f
SHA256d005b95c9fd7c5c1617b1c072a51b27e722a3228cc96dcdeda04a2a198d2a375
SHA512a71416a61fc3272fbd60ad2a958c9b1ef75d06c03fe3dbe878ac3b7f5ff725100b878be56d3fe792116c4e4092a7ce2d630a4d4c05c30b3555a3f3a5d90b428e
-
Filesize
421KB
MD5992c3f0cc8180f2f51156671e027ae75
SHA1942ec8c2ccfcacd75a1cd86cbe8873aee5115e29
SHA2566859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f
SHA5121f1b8d39e29274cfc87a9ef1510adb9c530086a421c121523376731c8933c6e234e9146310d3767ce888a8dce7a5713221f4d25e5b7b6398d06ae2be2b99eadf
-
Filesize
1KB
MD59de76d0bfcb1bb4569dabe0decfd7344
SHA18b7cac0fd9bd2b7d0b91ac9cd8aa9c9942ce00cb
SHA256300644c907d3e7fed4df2289a5af5c03fb526e30e286e4e2ddfcfe280ddc9ee3
SHA51245de31539b955b9f96169565fbb898257881f66482d2e6e5e2740a9deec25812ee15d68af812ba570c21fc36ed33b4caed9a678e0abc14b3b414438107845179
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB