Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 23:27
General
- Target 671cc0d3c8b5a2c9c0d89d1db82352a1_JaffaCakes118.dll
- Size 1.2MB
- Sample240729-3fd5mswcrp
- SHA256 7a78ee901e05342f602be1389c56ac136730ae36a6bf21b6ad2f70fb1198c070
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\671cc0d3c8b5a2c9c0d89d1db82352a1_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\EGZkbxz\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\EGZkbxz\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\EOD0L\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\EOD0L\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\yoG6cr\psr.exeC:\Users\Admin\AppData\Local\yoG6cr\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SYSDM.CPL
SystemPropertiesPerformance.exe
SYSDM.CPL
SystemPropertiesComputerName.exe
XmlLite.dll
psr.exe
Txrhelfambrw.lnk
memory/2420-81-0x00000211A3BB0000-0x00000211A3BB7000-memory.dmp
memory/2420-87-0x00007FFB3ECB0000-0x00007FFB3EDE8000-memory.dmp
memory/2968-0-0x00007FFB4D480000-0x00007FFB4D5B7000-memory.dmp
memory/2968-3-0x00007FFB5BE50000-0x00007FFB5C58F000-memory.dmp
memory/2968-40-0x00007FFB5BE50000-0x00007FFB5C58F000-memory.dmp
memory/2968-39-0x00007FFB4D480000-0x00007FFB4D5B7000-memory.dmp
memory/3440-15-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-12-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-16-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-30-0x00007FFB5CBD0000-0x00007FFB5CBE0000-memory.dmp
memory/3440-13-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-14-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-36-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-17-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-4-0x0000000007EE0000-0x0000000007EE1000-memory.dmp
memory/3440-9-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-6-0x00007FFB5B6BA000-0x00007FFB5B6BB000-memory.dmp
memory/3440-11-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-25-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-7-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-8-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-10-0x0000000140000000-0x0000000140137000-memory.dmp
memory/3440-29-0x00000000071F0000-0x00000000071F7000-memory.dmp
memory/4364-70-0x00007FFB3ECB0000-0x00007FFB3EDE8000-memory.dmp
memory/4364-65-0x000001D420970000-0x000001D420977000-memory.dmp
memory/4516-53-0x00007FFB3ECB0000-0x00007FFB3EDE8000-memory.dmp
memory/4516-48-0x00000183DAFF0000-0x00000183DAFF7000-memory.dmp
memory/4516-49-0x00007FFB3ECB0000-0x00007FFB3EDE8000-memory.dmp