Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
29-07-2024 02:26
General
-
Target
334adbca3e999c94a0bffe4648723a0c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
334adbca3e999c94a0bffe4648723a0c
-
SHA1
2d7306300ac5a1664cb91635ab3c3d6f99b7d4bb
-
SHA256
e5fcac5911dd1633ceac928cc930e5041484bdb95ebb4dba5103d2add754f741
-
SHA512
f42d2a5fc6c89e6a897f1733d85fbd096b7c702ee92edf7b8182e60efe27cade4fb2ed62e95752fefe9b136f910ec63e7cad7f4ddff7492a2378880dc9ed3fbf
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\334adbca3e999c94a0bffe4648723a0c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\a2h\LicensingUI.exeC:\Users\Admin\AppData\Local\a2h\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\tpBHcGz\SysResetErr.exeC:\Users\Admin\AppData\Local\tpBHcGz\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\kVbu\BitLockerWizard.exeC:\Users\Admin\AppData\Local\kVbu\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5d8eb0d7036671b9851bb590f6b582609
SHA106921aaebe47e7d26cb9aeba391850c8df854711
SHA256f6fde28230a419dafded865dcc50bf642452470827351130d566035b2f5500fe
SHA512f56000b5e8c80532c9d33f22421a255889323d251abfc84864cc090d99bf30e0ab6aa9422ad483df9e7deef8e2ab8d77224b0bc127827323510e7967d19288ab
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
100KB
MD56d30c96f29f64b34bc98e4c81d9b0ee8
SHA14a3adc355f02b9c69bdbe391bfb01469dee15cf0
SHA2567758227642702e645af5e84d1c0e5690e07687c8209072a2c5f79379299edf74
SHA51225471b0ac7156d9ee9d12181020039bf551ba3efe252b656030c12d93b8db2648a18bdf762740f2a5cd8e43640e4bd4e8742310dea15823fc76b9e1c126876b8
-
Filesize
1.2MB
MD53309a2b189b24c6536532f86371e6039
SHA1fb37acd09a20f21145dccf693eb9d9238743369a
SHA2561f5d119b472802f2c5f84e58472a94f0b7df83621e122586ca9b601dae0ff9a2
SHA5129b5811f53d3ecafdf288b58697b94faeef1ab84c32f1f8637afbdc7923f0837b69cb81ba0e0b3b345e133e3c8221255732e8a621b22679cb0d3d37b391f5dfaf
-
Filesize
1.4MB
MD57335f547b54e69931e9b831a54f58c86
SHA16423fa790e0d13357ecd7a57b049083eb283173b
SHA25682ba4dd84aa4ed363c131f8f4a013e3954e594d9d9de8cbe3f7f8e7e6920893a
SHA512556eddd795fc7af64ab2b2a283ceb5e65185e2b63783a75e8205a52ea495829ab7eb1bf3bf36db1fb08939e430fd9b12770f00708b232d9ae954e633d60f6e66
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
1KB
MD5584b5e403e5f93de31696d80bad9903c
SHA1c705b922da57d960cda500ea2fbf368fb557a8b0
SHA256480b73474dee07d37a9d0234b9865421ec839ed07fdc486741a61acc2bb05fd7
SHA5123aed9ed2886634f38fc1ededc1252c2f8f7707182e59ad3c0eec30467ec03c6c09a3b1dedc24788a26da23e4203df5eabf509a0a6f9c407d833d0b11c816cf97
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB