Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28-07-2024 21:17
General
-
Target
246baf200fe0776877875b48895018aa_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
246baf200fe0776877875b48895018aa
-
SHA1
4305c8cdb722247ffebfea9f06b9233339a606f9
-
SHA256
f73f90888a503e9599d2845337707f5d38ac1585fade9bd3eff224e65cbaa340
-
SHA512
78947ad93fc4cecb64f9351531519bd04c41f8ddf73cbd1ad3de58ccb027b646f9cff9cdcd438260271c076ae01c846cdecd5c0950b706df597ac88b39ada54c
-
SSDEEP
24576:kuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:89cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\246baf200fe0776877875b48895018aa_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Users\Admin\AppData\Local\fhD\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\fhD\ApplicationFrameHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\mP7VpG\DWWIN.EXEC:\Users\Admin\AppData\Local\mP7VpG\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\QooC1XT\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\QooC1XT\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD55b8de384a197e5fbbb352934527dc03d
SHA10b0b7e280ebe3bd9c7b46d2f1b22a8b076119e8b
SHA256e9d19ee3b3a0c28db0c6130e9af0fc7a3be286cf9e0985c3f83c24df39e5f815
SHA512b865f12962dc2c7044b47923758553ac216f7759dd94a43fcb6750f76257f09d32afbda1abf0fba300336a3c6420e8f05d6decab6c2c5ba1a7b1619d5d058082
-
Filesize
44KB
MD5591a98c65f624c52882c2b238d6cd4c4
SHA1c960d08c19d777069cf265dcc281807fbd8502d7
SHA2565e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA5121999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
1.2MB
MD5b8ac04fde9296d1309e62fb2a514bd9e
SHA13e3776d343cd298a55496204d7b169c4b2119066
SHA2564b7d4914dc2d6ac82d6884a1a9d116d9609e956f00e19ba12b6335ee8f99e590
SHA5123ad07b4b84ae53f385109d7545fff2d9b0453111de91eccc545d84784c3a07796232418a31e49873e52b7680345fd48abf7af1ff85998fcc296652be5ef17ab9
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD5607d37f48554ef27a2c68c2e03cc1afc
SHA1de9471ab5a3486812cc52ba7f66ee362b2ba0ac8
SHA2561961829cd9dca0dd39618e9bc3955be76b5bb62c1eafc268a07cf4ec23c3de08
SHA512242a98d769a9db9916eda5f183ae161c283d55e211cf0ec163586d32111bb59ac9788432059c76176141f7bbfe51d8cdf565ec88db8b543e5eca99efcf5d2b94
-
Filesize
1KB
MD58c03a6d55f6f0cf846edcf7247a55b22
SHA1446017b5428b27a953ab47b24894ab55923a31bf
SHA2566114ac1b86b878cf137e9ac4f695f25387b5e54ec143ed6b4d2453adb1c25b66
SHA512401873e136bea708aff41a5ec27ebf09dca8f5989f1a8383804529a2155c1bb45f03621bbe189974ae5331f534441b11e176ac40ad07d68d4e554f72b85f2e77
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB