Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
28-07-2024 16:47
General
-
Target
183815da44d7ed5ae8729924751f4708_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
183815da44d7ed5ae8729924751f4708
-
SHA1
814251ed5022db70b1fbc52aa18b04bad3e20a15
-
SHA256
b02ff992c112d00fcf1259b6ca963384f823e45f0538a91b75c6c2349862dfea
-
SHA512
f796d19444f9775721369f99a7d00ca31c83deff9df183524b81ed3675dc14e652b5c7af13b4eee7854af9703388ef4c96b6f93594b64d33e1ed7a8c0593a998
-
SSDEEP
24576:+uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:+9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\183815da44d7ed5ae8729924751f4708_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\LHhzGw\eudcedit.exeC:\Users\Admin\AppData\Local\LHhzGw\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\TLYz3FMhd\dwm.exeC:\Users\Admin\AppData\Local\TLYz3FMhd\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\KRELYfI\OptionalFeatures.exeC:\Users\Admin\AppData\Local\KRELYfI\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
1.2MB
MD51c3561e223d54106e867825d612c63d0
SHA1ed281f7a3028e3fb3e5d5773b78a03817857e990
SHA2561d0ffe1b59bb0148c32d13831b66574ca6a1ede3e2866140b45bed81c4cd2e25
SHA5120f89e746cdac7c0430050f4a0d5703177dd40a3dfba0f93cc34af99b67149ddee369a18a256b09f2bbe8d4aea625f9b1d54fee88fcebf749bc2cd23358f7bf4b
-
Filesize
1.2MB
MD516b63ad22d898be7c94bcde19136e2bb
SHA185867166dd822e44d7d28ea63f44150e7c273a5f
SHA25601282232e73906b06b5610540a7404c12adf0c15750480a7e0c7f2e0028e7b58
SHA512f93c53e63e456a98bf287e8427454655dddc9c672c8ca1d12ecc604dc6e3f16b8201a9d57360a3aeb2c2de68fc7c21021856552bcb436832967de5203ddaabdb
-
Filesize
365KB
MD5a9de6557179d371938fbe52511b551ce
SHA1def460b4028788ded82dc55c36cb0df28599fd5f
SHA25683c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe
SHA5125790cac8dae16a785b48f790e6645b137f211c1587fb64ea88e743b846ff3a886324afcfef4bebc61f869023b9a22ba925c461dfb2e12497b70f501e6b79153c
-
Filesize
92KB
MD55c27608411832c5b39ba04e33d53536c
SHA1f92f8b7439ce1de4c297046ed1d3ff9f20bc97af
SHA2560ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565
SHA5121fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309
-
Filesize
1.2MB
MD560c56cd309e1aa5b3de885dca31733b5
SHA1432ce9d05a440a4def77d362933cb083eb9db059
SHA2565625ce9e356e8dd63caec6eadf19d3ecb25ebc660e6c12f92389dd1ba6dc610d
SHA512df7c828b0bba0dc3a61a5690277a7c63138e55e6517d6fc08bd8e60fe06928a893eb8baf33ead5b29f07dc44b686cfd46e80b2588b419fe474d7bdba9bbbc990
-
Filesize
1KB
MD55995b351514599638a20cd4275c5ae83
SHA183bfc246d940b096c5c8e114c82f952e18d4788b
SHA2569aa71fd3581ff73704fb0b9ea2252cbafab84138e2281092c2fb1da9ebf6d099
SHA512e4303323c765e08c0a5e55c0340a72a2b1d88fa65c0bd63ded8aa395ad4daf75799bbc9df9865ee524d6c7df066e51a55be44447c9857f3174dd92af2d859bea
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB