Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
29-07-2024 00:52
General
-
Target
2eea949d5e460e676cfc46fedbfd7228_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2eea949d5e460e676cfc46fedbfd7228
-
SHA1
1aaa16ff737078f33d1d3a1698dba0c06d391505
-
SHA256
0957af4a0171acd92171ed5b6922e5209095058c4d80bb1cb3cc770810c1786d
-
SHA512
0d1df077e17274c752997be07d6337d3548b259af0da041dd48f86e64e08c3db2c32107d78698b25be88953cb2bb83efe044a8ac1f1879393b985b39ff17cba3
-
SSDEEP
24576:/uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:B9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2eea949d5e460e676cfc46fedbfd7228_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\Dsc8\tcmsetup.exeC:\Users\Admin\AppData\Local\Dsc8\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\sEd9\tcmsetup.exeC:\Users\Admin\AppData\Local\sEd9\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\YQv5v\DWWIN.EXEC:\Users\Admin\AppData\Local\YQv5v\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5690c533ea8543caac701004414239744
SHA1f6c9cc6c2355c0225adb252b3d3a19f7e5051403
SHA256a1e71851bd41519d3eaca7b7f15f28d01cd29bd5ee88d8f2e2171ce14399f9c4
SHA5120a2c10c35dd27b96651e5e76f115eec01bffba2154b8f8a4cba7c83a922fc9e42e8728a57457c2d1bde8f2b1e4a9af9ca91509775d1ad407e290d28ca19bb469
-
Filesize
16KB
MD558f3b915b9ae7d63431772c2616b0945
SHA16346e837da3b0f551becb7cac6d160e3063696e9
SHA256e243501ba2ef7a6f04f51410bb916faffe0ec23450a4d030ce6bfe747e544b39
SHA5127b09192af460c502d1a94989a0d06191c8c7a058ce3a4541e3f45960a1e12529d0cdaff9da3d5bacfdceed57aeb6dc9a159c6c0a95675c438f99bf7e418c6dc5
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD5204cbeccb03444044025c255d68273bb
SHA1fe69fcff084a7becbf3b74001a0ee8787ea1c5f8
SHA2564335b1961135cc83d98c7b63203fbaf80c4539be93f73bd34e0cefe1cc3a98f2
SHA512b51cadf6fc858a0eaaca59b15150f42f56226bd6e8ba853046efa3ebd643038478c8081c4fd00b45ff38a66cb1452eaeaef9038aaf3f7d9c434ac802622b85fa
-
Filesize
1.2MB
MD5ce4a601635ebb9d18df34b5e1aea0e1e
SHA149bf177e8103d55dc19508a7bb933ac90492e7d6
SHA25638510a3bc28c7327ee62a35507387909ffb5effcc574660c158f0062972f23c6
SHA512379d8e459585d4098be0d9280b12e34541fece24ca6d65bafcdaf66f78e7049b069b51faee85ac9abce1c79a91775af841d9aff27cbbfba6beebce246a66dc43
-
Filesize
1KB
MD50e5aafea786c9c2b9a083228e3de491f
SHA144a922a54fe58fcd92a5f132d21033a2d7a95fe3
SHA256e7bf3b57f045d841a51972fc1f2bf17582b6c1ad6c1669dae7d832e365946e71
SHA51215f284471eafa4601443bca6f28859d098dbd054d4547bc3eae9cb3098986fcddea32f2c0fd2c2373242886a57a5997f5a9cd63ea2e8101033974e3c8abd2b91
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB