Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
28-07-2024 19:39
General
-
Target
1fcda2221e8944f12e34e61b96fbf88f_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
1fcda2221e8944f12e34e61b96fbf88f
-
SHA1
c26145b0db9ad0248dfddd89daa1894826069a39
-
SHA256
a2d0319fed40865b788210013d7a165b8a3d7ec6bb847d4529dbf2ba073a8f2e
-
SHA512
d9013272340b574863dafb98738d70037fd279a809c9c4f5e898540c5fbd59fe53ce2aa545a03d3ebdcc922dc8da13f5a781624e1d858bb7784d59cb3322ae0d
-
SSDEEP
24576:7uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:l9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fcda2221e8944f12e34e61b96fbf88f_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\7R4JB\unregmp2.exeC:\Users\Admin\AppData\Local\7R4JB\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\5GLmi5\wbengine.exeC:\Users\Admin\AppData\Local\5GLmi5\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\vNoHmt\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\vNoHmt\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD54a924b8788f9f88e64cd42ba3fd7efe3
SHA1192f72c4d376e4a6111f082faa623fe597805662
SHA256e899a0691e4578122d0b15ed264380361c7b2276507bb5364ed80063e7f7edc1
SHA5121df0e3a314e9bb395f10079f9b24c2f9c16f077c1c450bcdf56ff4d763eca27c2de356c2a5f1b24f74e1c9f9457eac57c1ebfdb4148ed032b22cf2d9476dfb91
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1.2MB
MD5a5004862e79c1141c4c4246c4d50090c
SHA13e65e9363e18d37462dbe2961aa45558b3c0cd13
SHA25651fccad9013421a8bf26a3fded9afbfb22eed9bc794b1cc3900f0dd6f01448b1
SHA5127a121aca9342fe37d2f68cc410fa1c47acab542e49b013110c9e4382206fef188d625f8734a650d7511f0e8d1616561b4d2ea1af0fa34e94a7048795420c5fb2
-
Filesize
259KB
MD5a6fc8ce566dec7c5873cb9d02d7b874e
SHA1a30040967f75df85a1e3927bdce159b102011a61
SHA25621f41fea24dddc8a32f902af7b0387a53a745013429d8fd3f5fa6916eadc839d
SHA512f83e17dd305eb1bc24cca1f197e2440f9b501eafb9c9d44ede7c88b1520030a87d059bdcb8eadeac1eaedabcbc4fe50206821965d73f0f6671e27edd55c01cbc
-
Filesize
1.2MB
MD5d41e6c8c44226b2fde360a064525d9d9
SHA13d8c5db8a601be10eef0454b6ed333e6b91de37e
SHA256435a4fa022db3f9291d13c2160cf45a31fdd2aa724797a456fa8013b67b8ee40
SHA512ee765b4c4b21c88428c9d2ffa62d6f1799f321c34edf706f47153796c755c65049310be31ef9c13b02b40285d7f45b93ee454bf986733e8d877d0a467d560257
-
Filesize
82KB
MD56711765f323289f5008a6a2a04b6f264
SHA1d8116fdf73608b4b254ad83c74f2232584d24144
SHA256bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8
-
Filesize
1KB
MD59c76b16d9a562ec12734ecb70b55cd8a
SHA1024266365ee7205a7b1dbf2add13f12d4e09ba8f
SHA2562aab4597be88730383d0e98458867cd8556e4d0e382c3416c9fc79850552d42c
SHA5129bcaae848001d9c50f8765827e82fef059b5c6f154e0be6601dbf0d977962c7b77186ac59fc69aacafb13180c2796b28e08422e6e2266d6b159c45b3343d2c20
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB