Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
29-07-2024 02:04
General
-
Target
32537f50522e3740a5c02b2b70095c69_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
32537f50522e3740a5c02b2b70095c69
-
SHA1
33c1010b9daea842501a2c4c854d4084d726880d
-
SHA256
5f25e058ec1e4e713a06af4af810eaeee84640b5b6a3995d8bb384e06e958f74
-
SHA512
660606f2c7cd54ae91a1be2fcbd41d52472ca3ac97880aefffa178b02f1c14df18a901b02267cfb58cfa441f123617f353ca7ce6d7c3b61daef5afb150d5b1e1
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NF:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32537f50522e3740a5c02b2b70095c69_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\JstnLnZT\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\JstnLnZT\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\60u0ImD\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\60u0ImD\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\6fdIIj\CustomShellHost.exeC:\Users\Admin\AppData\Local\6fdIIj\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
1.4MB
MD5519fef1556d3c9e048107f3ba5c7ea6b
SHA10eae9747e087265ad415d21a1d19efc7a0c4ee5c
SHA2565aa3707f5a7182040775c3398361a13b94eb7e0bf503d7c5f08ce8de701e6fe1
SHA5128da8603030a6463797a0617bce47547cb61b567a2c4efe17816795f05d16ecd031fb02682dacfba295b74ca08a627dff5478e335b3de95173deffda1c8cc115f
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
1.4MB
MD529cdd613fc5931580b935e46eb4f98df
SHA13df906c855cd9a3aaaa7c010f2269c0e25d38899
SHA256ff5b9b711449c5f4d308058b82bb1d2b28bdc2d8d138ede02eade869cf3ba461
SHA512ae07c647740a377a73c723fb1cb0cd7727903f6647f84d0f7327a1006907c3f0adedcf64d9bdd3abca14872b387be48db1f443fbf7603b958366ac706a13e789
-
Filesize
33KB
MD50d5b016ac7e7b6257c069e8bb40845de
SHA15282f30e90cbd1be8da95b73bc1b6a7d041e43c2
SHA2566a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067
SHA512cd44d8b70fc67c692e6966b4ad86a7de9c96df0bade1b3a80cb4767be159d64f3cc04dc5934f7d843b15101865089e43b8aecabddc370b22caf0c48b56b3430e
-
Filesize
1.4MB
MD5995ef3d76e209db15c52fa530f0d098c
SHA14623a9ffd0d42088397fe86a463deb2763078fd2
SHA2569efa681d1ce4a2bf558534d1d47b0bbd4bf151cafd85ef0496c067e2e6b68b99
SHA5127065cfb36a9c3d4c4f915bcdc0746bdad1ed94aa77b255caf9fef95517d0455c6e4fbdb99cbf7a085d2b07636ef2aeb4ed6124b9797c37aae8a7f3781f1cc75d
-
Filesize
1KB
MD5f7d743eeaa84d01c5be1960e39ea5cd3
SHA1d08571b8bbf712b3b1fdca131aeb0660db482fbf
SHA2567a0c5e7e41d5a439f9ab31ce244153ad7fca29ad743065d74cd051cae6648776
SHA5121c088a648722fca5598131a2191e7689b7387c90a7621fc282d664fbe63f38b5e9160be33b0871629a11e97dd7ea8599b177f2b31af2aa33920f2afcb0550920
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB