Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
29-07-2024 01:51
General
-
Target
31b7ddc62f5f53c4e73e7e6fc2ac8a8e_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
31b7ddc62f5f53c4e73e7e6fc2ac8a8e
-
SHA1
90bc55e8741ad80cc692f8916879afe1136d300c
-
SHA256
d62f7d5f5612a00f40af40dd9e4d077879f57a394e6c54cfdd8ac3c643212844
-
SHA512
2c1de038b2c6a2b090f0f17a1fc0118bbed7837496a7c7df345295039d16e1731c5274cde666880b5323eed51547b10a93a22efd7d2deffd14f0bcc1e8f611dc
-
SSDEEP
24576:luYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:f9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31b7ddc62f5f53c4e73e7e6fc2ac8a8e_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\yK74CC\osk.exeC:\Users\Admin\AppData\Local\yK74CC\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\DY1byr\tabcal.exeC:\Users\Admin\AppData\Local\DY1byr\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\M2K\sdclt.exeC:\Users\Admin\AppData\Local\M2K\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f59d9d89e1cce8073dc8a87b04eef236
SHA1d58d813ee30edce427a3392f8fc94801101086a2
SHA2562d2631c2257166ce9a4ca512eda924caca61c6f536be0a7e95f6c51285050c49
SHA512e3191479389c04a4294a7873a4554435bced3e2623f366c8d81f5be4de37eb889c01f6aad577e31dc270c1fda59c7ccad32ed5acd3030b0c9da9e349d147929d
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
1.2MB
MD593889f396a53a3181dd87f3afcd9011b
SHA188b8033430596649cbaf4c1f5a6f039416d395e1
SHA256be022f8c878ec74b5b0b4e1384089ddd95876df390e074f37c13a187e98b37e3
SHA5127e7174ba6cc3134059ae367b79bdff9210e6a98a30bf13bb4da60241477b81ca1108e3aad0983ce15fa3819530640e219895307b70da178a0d3da83386c5f5ef
-
Filesize
1.2MB
MD5e09d48f225e7abcab14ebd3b8a9668ec
SHA11c5b9322b51c09a407d182df481609f7cb8c425d
SHA256efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3
SHA512384d606b90c4803e5144b4de24edc537cb22dd59336a18a58d229500ed36aec92c8467cae6d3f326647bd044d8074931da553c7809727fb70227e99c257df0b4
-
Filesize
1.4MB
MD5b85ca7d0eebc4b29c25ec14341f1829e
SHA1734b1f6b79bb396e1d853611e07c3d074a41c012
SHA2569a5057bbfe805fadf00ffbbb6bc2c7ada0f1049a5cd1788420e7465dc6987b98
SHA512f0ea1d9d4a13b01724be519e568179af2f575d548e4146aefc12568e09e07150ceb8a14e4ee13f721533268bb690d2625fe905cdddb630295ce0b7d4d8ee6685
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
1KB
MD5f7fd5d7535ccaa450f6b09d7688aa068
SHA1a04d5beaa804a478150dd8783c89876b8d5b21e5
SHA256f12c211507faed9cc932ce51a570a9617abf8ad64018e208cac129edaa12a3f3
SHA51247ec978cd1c068a8873ee1c96470e918fa7c55b17c849843dd57e7a60607734b5ac022bf562c78770ab5ad164158ce2a3d24948dbbf96576cb7a9582194c70fc
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB