Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240729-en - resource tags
- submitted
29/07/2024, 20:54
General
- Target 5f8818dab2a7cd3744b8b49ec0deb5ce_JaffaCakes118.dll
- Size 1.4MB
- Sample240729-zp7a1avanb
- SHA256 52acbc82df4a4baa33511ee3dde268bcdd31df9fa405aa749d6cf3a65f7f71d6
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f8818dab2a7cd3744b8b49ec0deb5ce_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\tbSJhuaQc\wbengine.exeC:\Users\Admin\AppData\Local\tbSJhuaQc\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\uk0vQc\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\uk0vQc\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\d88sAiI\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\d88sAiI\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DUI70.dll
PasswordOnWakeSettingFlyout.exe
wbengine.exe
wer.dll
DevicePairingWizard.exe
MFC42u.dll
Tuujykmh.lnk
memory/1496-68-0x00007FF978400000-0x00007FF97856A000-memory.dmp
memory/1496-62-0x00007FF978400000-0x00007FF97856A000-memory.dmp
memory/1496-65-0x0000022981400000-0x0000022981407000-memory.dmp
memory/2432-82-0x00000278B6000000-0x00000278B6007000-memory.dmp
memory/2432-79-0x00007FF977DD0000-0x00007FF977F79000-memory.dmp
memory/2432-85-0x00007FF977DD0000-0x00007FF977F79000-memory.dmp
memory/2592-51-0x00007FF978400000-0x00007FF978565000-memory.dmp
memory/2592-48-0x000001725C990000-0x000001725C997000-memory.dmp
memory/2592-45-0x00007FF978400000-0x00007FF978565000-memory.dmp
memory/3496-32-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-14-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-6-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-10-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-7-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-9-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-11-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-12-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-13-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-4-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
memory/3496-15-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-8-0x0000000140000000-0x0000000140163000-memory.dmp
memory/3496-35-0x00007FF984D3A000-0x00007FF984D3B000-memory.dmp
memory/3496-36-0x0000000000E40000-0x0000000000E47000-memory.dmp
memory/3496-37-0x00007FF986630000-0x00007FF986640000-memory.dmp
memory/3496-23-0x0000000140000000-0x0000000140163000-memory.dmp
memory/4264-0-0x000002176B830000-0x000002176B837000-memory.dmp
memory/4264-38-0x00007FF978400000-0x00007FF978563000-memory.dmp
memory/4264-2-0x00007FF978400000-0x00007FF978563000-memory.dmp