Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
30-07-2024 13:09
General
-
Target
7051b4e07604f97d31c07ff0f83c9620_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7051b4e07604f97d31c07ff0f83c9620
-
SHA1
9585328616c046d78fd9a9cd61c98ca4504ada1a
-
SHA256
7da26cae9e489fcf070ff979bb244ed218c0b0fb16b33f36a0079c8b394ae41e
-
SHA512
9665b1fab2412dec8035e0c89a9395b5bb46534a7a0b4317e06046c35a5cf26a1cd14ac0df62355d875be2a3ce8a956fddcda21fa01e32175da2af62639da6b6
-
SSDEEP
24576:nuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nnpt:J9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7051b4e07604f97d31c07ff0f83c9620_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\yOVdc4\CustomShellHost.exeC:\Users\Admin\AppData\Local\yOVdc4\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\qLcuq\lpksetup.exeC:\Users\Admin\AppData\Local\qLcuq\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\cCxMR1\usocoreworker.exeC:\Users\Admin\AppData\Local\cCxMR1\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f899b6a8f0818cb694cfad337c36bdd6
SHA16763949640d473ae664d54f4d9198119b156ebe9
SHA256b19dc85ec027a97b33c842c50efde48ec6fff61d42d0d86e70e535924ac7a797
SHA512f8843b0fdc4c2517e6218e70845ec67c2489bca807599fbd7e4b0426f219455e544df25e7cab84dcff2c8f5c6d4ad4fce91b74c3733cb622d671a839bf377a85
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1.2MB
MD56f673f2f9de09b8515af87d2f52e695f
SHA1451ac0536cb70d44d8b6b9f2363db88804cb664d
SHA256a55a91c842e4747c2e61a7a05320470e9df476bdccd01e35f71784654c6ead33
SHA512176a8a825df535d1d25e9467d601a935a7270a7e5fe02eb747c8d2b356e5bf1da2eb0ee17a513f6780595359e96263e1812f778f1bfd3c493982f7af0deac155
-
Filesize
728KB
MD5c75516a32e0aea02a184074d55d1a997
SHA1f9396946c078f8b0f28e3a6e21a97eeece31d13f
SHA256cb3cbeaaff7c07b044f70177e2899a87e80840d177238eb7dd25b8d9e20bef22
SHA51292994fdb75b15742e33e6d7a499664b722e45b9c160d8cc42d30bc727044063d589f45853692b5b754df6ff0fd21294dc32fed985b153f93f4bcf9f8c89a5bcc
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
1.2MB
MD514ac565f066653a0dafb4a89c39429ef
SHA1809a79cc6d4e4a54b52de86bd048d0e7ae375108
SHA25697e6f685ac48819fea52af18318f5c8ab68555cac2fc6f90caae70fcb4a80690
SHA5129b02d776157c568c0d0aac7a9a5c2602f271f4b4d9d00a92e170d68a35605ce0595a99a869e691afc797622c735670b303b0983104cdda81b34069b364f4cb9e
-
Filesize
1KB
MD52b9db8511cedd3124e9d684c2500136b
SHA1589be04fc137a41f86758206f0559777dc12b235
SHA2560c84190c865978267f2b4bede29858a3e5f4172cbc7d8ef4767cd85004a70909
SHA512e4e5d84048d326ae6f7233e645702880079981f48ed8acd57173faca1c7445ae2bb7dfc3a7a69a573bbcfb9f03320f2205808a7a7f570b3e3f9fa95f880859ed
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB