Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
30-07-2024 01:28
General
-
Target
6d024b9363b39a0acd1de39d9e8e25dc_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
6d024b9363b39a0acd1de39d9e8e25dc
-
SHA1
abcfbed32e6c09c582051971904f85a8b88bbb5a
-
SHA256
484d7dea43a0c0e76df55b04cb19202f7fb13e23ed41cbd7746cabcd90a1c5c2
-
SHA512
984397e85bba6831163f155bf27a50956ed69d22fde69186bb9c74f1a76d12ea09cc01528d3bc9364fa3a8629eb2a838ddd65049f97cd1305ef0b8451c7a5389
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6d024b9363b39a0acd1de39d9e8e25dc_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\LOYSbakyZ\usocoreworker.exeC:\Users\Admin\AppData\Local\LOYSbakyZ\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\Ax3k\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\Ax3k\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\vQshI1K77\msra.exeC:\Users\Admin\AppData\Local\vQshI1K77\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.4MB
MD5cc3f6d3cb4df254ab32a1ce259c76683
SHA1d64b410ba9ac3b054bf5b76590cfe1115edf6b26
SHA256436b2e495961e65989fd550584cb400ed87ed17a03ea76d4630ec6dcde3bee6b
SHA512fa5dc8da261b2d43028251a06f1f196c73b5966613d4d02ee9d13a74d20266777807279f2f69b79530a16066a756753e32938f28f4f864af46aed70e16bb79fe
-
Filesize
1.2MB
MD57aef04b51b214372176ceebc5d7c65f4
SHA1c94bbbbd342aad3af1da7a3aa6565e515a8dd90f
SHA2563e21152c135cfa9053c8f910817d9149b991b54ef194c5f3fee432cfb68f74aa
SHA5121bc5ea6446faa009f9bedf488753c5b9d21a7dfb01b86cdd951d77dd61870164e79b739b8c6075204811d1dcb77410ea17a6a95548fea1af450a3aabc27b725f
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1.2MB
MD5759a2ea17866bd64380c716dbf80a5b0
SHA12adb2904990b02c55437c086ec74e94d735f8435
SHA256f70a9f739a1cdd3ab8f71cfc6111c3ab62e225c671b8aa2e92a8f18a28713ff1
SHA512b934e0c9bd98b9ea38437d34b24ad7889ba2cc534281281682189578c3896cda49b54d48a58a7dcff5dd1c072d8d054533a61bf4e18516adb9c78c0361e1be27
-
Filesize
579KB
MD5dcda3b7b8eb0bfbccb54b4d6a6844ad6
SHA1316a2925e451f739f45e31bc233a95f91bf775fa
SHA256011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae
SHA51218e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5
-
Filesize
1KB
MD5101197411128aec0974276935dd094a9
SHA1972aaad59860ed4060fd0403aabc8c643cee69ec
SHA256fcdeaa643de96bc169f1a3c0fc4f6455c4006b05e110f79332ed55fb165e9dee
SHA512d2ac2fd14751d6fd1b3f0ace1147ae40a5754d38a9fa44e7ba32cd0186f2f348b7246ac467c1184a6cea9cbdc06073892652f4749387fa5e1872552f0255436a
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB