Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
28-07-2024 20:27
General
-
Target
21f932546446e084908765994b75052d_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
21f932546446e084908765994b75052d
-
SHA1
ad0414dbc48e0ae9fe223b9645d5eed04faa9078
-
SHA256
3652a2d2f0185a50473b526745a81a8e88e7fe64374ca9ebf6e5dbab1f0c580c
-
SHA512
ab55c5c2b4c1622b9005f808693e7f9b1dc3de18296ddad3d11dfc50c1b0cf58b8bc78ca4833b643e4218174ac33a624f23e7a4eee5f801ce4adf04b3fe38ffd
-
SSDEEP
24576:MuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:k9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\21f932546446e084908765994b75052d_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\jiFqzLkU\sigverif.exeC:\Users\Admin\AppData\Local\jiFqzLkU\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\Dece\wbengine.exeC:\Users\Admin\AppData\Local\Dece\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\AqF4\Netplwiz.exeC:\Users\Admin\AppData\Local\AqF4\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD570ccf96c88e42c6821ad61252aec66da
SHA1d6b3f949df1cdc2b603fa62d219a836854b70292
SHA256b18161515e7d387a1da0a0740f289ae28e8c1de693d7432b2afd46ad2c1006b9
SHA512b3aa686b1bbd9a408fcc0b26cac492e7bd492ce044feb5ee7e26328042f73e533c043c627f8b269fb634d97d8962d1b90dd60d2a0beb681091ad4733cfdf6046
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1.2MB
MD597dd1589863aa937ec5a0e89ce1641e5
SHA1494b21d3a509d7a7a09dab5fc263a3069d8b33c0
SHA2560939011d787ba8b2ae5dc981e9751803332e1a90432c4df273c1039a0ae61c0e
SHA512936860d1c83d9e516e50c19ceafd74ca01b1ac9101f0de5537bf8a79c4ff29caf38255feb07d1bd38b6e48fd5b83e7f8e095d8ae585ed0bac42e1287f82a4a07
-
Filesize
1.2MB
MD57392a02732c1d171b9fdfc5449d66d9f
SHA1537e3ea0cb56beb5623958ce7bd6834d40dbb167
SHA2566bdba0a9f0df29d4cb34be49c1d46f651619f39b59bc8025532768a75c76d2e9
SHA5127d3c6826181d3b411f91c1d08e425a09db5df24560b49e80acfb9f8ae056263f3b358410d4d1aa1b5807888f08bc33b594a68e99f78e52d283fb68d498640c83
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
1KB
MD5213c88e21d9da5e05d98ab090c5e6b80
SHA12b7fb83df36b788406faf1a7ff48a2f3e6d26508
SHA256863093ac019ae34cce73012f2bf876af1c85406c01ef61f28c2a330872236066
SHA51298bc25c03ee39fb2e7a8f01a1a681a0b83095b02f689c901ff6f12f7ae9fc701b5cef608eae078c6fb9509898ea7a2876c8437e649a933011d7077c950ee4224
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB