Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
29-07-2024 01:22
General
-
Target
305ed1795e2e32ab6474f11e8a2b90da_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
305ed1795e2e32ab6474f11e8a2b90da
-
SHA1
36691323644bafb435d160a6d91caabba435a6de
-
SHA256
f2ddef77e116e27aaf7edd19d8e311c890be77abd321a104a19bb4beb6a760d5
-
SHA512
eab5c510385fef3fc598f15b65c6b91e966ba1590de17c839e4a5a9816526463f91501a5006209e781e15befd240ff7cdb53e57103dabd319483598926f85500
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\305ed1795e2e32ab6474f11e8a2b90da_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\G35NadLhv\EhStorAuthn.exeC:\Users\Admin\AppData\Local\G35NadLhv\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\ohZIs\DWWIN.EXEC:\Users\Admin\AppData\Local\ohZIs\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\XGltj\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\XGltj\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
1.2MB
MD5e94ceedbe1c19f150765e4b818f07e94
SHA1b959ce2c2a3fa10d471abc3ea6fd5eed1b158d17
SHA256489c5a21ecc5b587160314f6f1dda44f3d2c56d672177a52a03e1370bc7759a4
SHA5129b4d9cbeaa21f0f9868708e1f3521bbfd39b7f3e495511b40fdd122dc6c7c650b60a1cf112170fbe3993f7805f3aaa5fef99cc292fedd282fb82a5842ccca334
-
Filesize
1.4MB
MD5a5213bba342f1833576de9bb3ef6b7c0
SHA18dd8d975cf9e5dedca06d4b80856a671f54f6018
SHA2563e5a99741e5c497ef362a3b2118007912a7662a29813db0ccd64b3e4392f0bd5
SHA5122b0c214ab13fd33c5961474fd468ae8be666e4061b7eb634d229ad5bfd00fa82d3887cbfc1186d00ac333120c298670b8c83cabf122c43044d763bc13cdfa5a0
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD562c3c9778ae8c7d0319344c15a3dd67c
SHA1e0c261ae0107912742a32df5649cbe7c050914c8
SHA256b79cfe71a8b6f491fac23d52d2b4d8608b46c3fd037bfaaf4ccdc68e0efac423
SHA512cf46ef078a3adb53db884183ddaba9de27458107beaa6e8259cdb5059e5f0f20748cbb1de9d92a86a5ae30c2caa0f0bf7d2d07bda36e18353a9fde8a002f1c42
-
Filesize
1KB
MD502ebe9579518a5c4148b6a7c8ca7802f
SHA13eb9e3cca1a0486074b85331a08209a536da2341
SHA256f31b811e512133fdcde61f6ad0d95977c1bfa724e79c260d51f70f618ca8ce99
SHA5123da366bdaf8b9e181e59cf64dcf932d5e47d0282a21641fb56020ef3aab8d0ae41e1de8988ceb8298e5926274f3c5a72cb34f82911ec2168dff41279b1da1ff5
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB