Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
28-07-2024 19:54
General
-
Target
20820c2a9bf906522a7592b6a394f25c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
20820c2a9bf906522a7592b6a394f25c
-
SHA1
9468c6497d136660b8349d1748ba71152b749509
-
SHA256
0837def50bbee311ec7d43a7769cea5a285fee80fc6cf2a9796573cb400bf4e8
-
SHA512
6cefdee4fbb47b90237dc4a57f1c568f03de10963357fc6d319e2f9566a592f5605f4113dc471afc87329199cdecdf7a70b170d6af50be36e322ed7c4eb8d152
-
SSDEEP
24576:XuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:Z9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\20820c2a9bf906522a7592b6a394f25c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\pyq3Sr1\wlrmdr.exeC:\Users\Admin\AppData\Local\pyq3Sr1\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\1hovx\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\1hovx\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Users\Admin\AppData\Local\ZQDpmE7\RecoveryDrive.exeC:\Users\Admin\AppData\Local\ZQDpmE7\RecoveryDrive.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD55e80c09f6b5d33a8dd0ea232e30dfa20
SHA1f295bd0a2165f9307533e2eb3716e2b19473d497
SHA2569d43e6d27094f25ca0825fdd58785ac39a3d23d14e05509c288551b7039d0208
SHA51268cca080670dbad61e4cc1fd52994a3d1e2049b48524eff13f9b702ee56af2dafa6c235d801119be6c4e0de97561660fe3e981094cccba2ec2396be49c07b26c
-
Filesize
82KB
MD5e4fbf7cab8669c7c9cef92205d2f2ffc
SHA1adbfa782b7998720fa85678cc85863b961975e28
SHA256b266318d45a4245556a2e39b763f2f11eca780969105f6f103e53dd0a492bb30
SHA512c5c62578d04133352d6cb7b018df96a7b55c18d6111ab8bf2bfe232a3315a63b07047fa5b0b88551d152085776c66169b47566242c8c4c5e0333c55adc64e1b6
-
Filesize
911KB
MD5b9b3dc6f2eb89e41ff27400952602c74
SHA124ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA5127906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe
-
Filesize
1.2MB
MD5dc8f904e5914e066a9b970e38135f22c
SHA1bfbec273dd2801a04f8185890eaa90f1a1ccf94e
SHA2567db6b25f5a3d2ba133f994fa4093f374f42cc3afbe184f022a92de65480a7e3e
SHA5126a734c93d55852eef8d6789ef70ac69cd02189258137d29385184a7ef2be3f89859899663cc400d9d47d95bb80b0d57f2c25e9ca0a9a89587e438fb160533613
-
Filesize
1.4MB
MD5938f0dc810578a5f3d8c6dbef0b866f6
SHA1e79a7eafd2c20c65bf7b9bfde2623ad98fda508b
SHA2565254f5ebfafd2c297eb496fcb927cd0f75382391eaa0f3a1c219ce41aaf64bdf
SHA5128be8e9f2455b1d3308179ffab5cec2084035008d69521831b7d9d7b4183e9345296de26fe2f77df96e51ac24394947c08c6cd199e32207db1016a13387ac505d
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1KB
MD51eb49542ac233df22fe0c6a32afbbe58
SHA1b7643343c6ee63c90d32f573fef054dd84870dd8
SHA25693a8aad943cab5205e999ce3c0629b51808039376ec659554c2d220921cd3966
SHA5125bf87884abd1f65e97032f893e006b3c28ddbf5339078db644d7da13ece7bd754d953b2b3d38aa02138107392e5b138c42960e0c975996252b6ec0315852445d
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB