Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
29-07-2024 00:48
General
-
Target
2eba1f3e3c4d522681391430b61ebf5e_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2eba1f3e3c4d522681391430b61ebf5e
-
SHA1
fa261d032dff878e2b05185a88ff061f2ad8cc79
-
SHA256
3b2d01d04f1d9eac4c480c16befd364cdd797febe47b96ad4a78380af63cf33f
-
SHA512
e35975deb8ec44d47cff6ca13407511b8dca41706069ab975c28e8f606c62b908e7e6c8298e0e975a4cb4f816f4314de895e6065eea819351384e6023227bf33
-
SSDEEP
24576:2uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:29cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2eba1f3e3c4d522681391430b61ebf5e_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\dsOHoIrlh\slui.exeC:\Users\Admin\AppData\Local\dsOHoIrlh\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\buY2hc7P\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\buY2hc7P\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Taskmgr.exeC:\Windows\system32\Taskmgr.exe1⤵
-
C:\Users\Admin\AppData\Local\Op5XUVlSp\Taskmgr.exeC:\Users\Admin\AppData\Local\Op5XUVlSp\Taskmgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD55ae62c2ffd5208f265521270938286a5
SHA11d245ca2c268aff3a7b5febc4f85dfc41582d672
SHA25649449e95de4beec16930bb8076e22774ff54d18a6fe2d50dc2ea13dc67b9767e
SHA512d0896436b310a24772b624b329ac0357cc251b387b21fce55df75eac2497cef532e708f6b934ce75a289376da3fa1a0bcf48c8745a812c18de167ef5a2ae9268
-
Filesize
1.2MB
MD558d5bc7895f7f32ee308e34f06f25dd5
SHA17a7f5e991ddeaf73e15a0fdcb5c999c0248a2fa4
SHA2564e305198f15bafd5728b5fb8e7ff48d9f312399c744ecfea0ecac79d93c5e478
SHA512872c84c92b0e4050ae4a4137330ec3cda30008fd15d6413bf7a913c03a021ad41b6131e5a7356b374ced98d37ae207147ebefd93893560dc15c3e9875f93f7a9
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
1.2MB
MD565694730f2ad168209481e79bb5fb40a
SHA1821f95acc6127c26eea869e0991b8477dca42da5
SHA2567e3322988d09dd8831a564077d995f1911b3e6a04eec9497934f5090ccd56274
SHA512dfadaa3977b2e5b9e97480497e61ab040abc0f0141b4cfbb805739d81a66b3992cad5c950122c6a47852c9d82c4f2c4cee9a763399febfed1a73ed20047156cc
-
Filesize
1.2MB
MD5aae8385e26535806e734e560102b692e
SHA170cce79de6699a21715b8eafc53d1ac20771283f
SHA25607700cda1dbb641ba93cd89f9396465494728c98e1629660c3c497ef6cffad31
SHA5120547d5457fb54994ce3c9170a8bdda7f04303fca997a00668c5b3d0bf680d22aa589d632097e58921eb4fb9859b842ecb7da475d5865484e5134518ef8df9944
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
1KB
MD5897b6c8e9cdb11f67d72bdf57788d12b
SHA1ec55c3d1430c52fc5b3ac9d8d7ca2efd589c5c5e
SHA2562ff2b0dba880de27add1e6fc1784be7c87dc267b025c15256e071bcca18cb55b
SHA512991523246f6e663f9cf58dbc6c7eb384fcf492cccee3cafd334b286e6abe2dc8cb1ef546d326fb5f92b2665c9ba9b57d7eacef2b0b05929576674bec8fee6954
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB