Analysis
-
max time kernel
97s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
30-07-2024 14:20
General
-
Target
73eb5182708f94d4d29563da6ccaccb9_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
73eb5182708f94d4d29563da6ccaccb9
-
SHA1
2dfcfa915d7877942745d3af43fe5d017a3fb0cc
-
SHA256
e27f783be3af08c4f00e2b4db7c18fe736c86979491b2fc1e849b1e5fcf97b63
-
SHA512
c959b398348a2514752d72a5fe7e8ff66ad19e577465efac1f03fe6861f22982f0af8e7e0e1e4639f7845b58fcbb1b45f42e55fb8af1a903f37691726ebc3071
-
SSDEEP
24576:tuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:n9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73eb5182708f94d4d29563da6ccaccb9_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\TDYzlzR\AgentService.exeC:\Users\Admin\AppData\Local\TDYzlzR\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\YjgNPyo\LicensingUI.exeC:\Users\Admin\AppData\Local\YjgNPyo\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\bBi\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\bBi\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
1.2MB
MD515c81291102a49e59d82604079abf3c1
SHA1b1c10f5ac8c6ced36cbc426851f7100635994c9c
SHA2568fc78c96efee3fcbbd8291921b5f71f90cb7e510abfd3237d588df61f8cb45c0
SHA51247b77fe9197997113fef40f8048a5d6b5a2a21a33cc5572eeff18c21ea367d3a1edd76aea92596c2cc2b24cb624ace5e86faf769133330483f519a2fe2296873
-
Filesize
1.4MB
MD5fa1a54dfacbbeb9d3b7e4a73b1d3c994
SHA188ffb1f007a80213e185572774a58e3c9d3cca4a
SHA256520831909e2f4a10b912bed2bf30235989dcae8cf44c69da581cc266fef9a7f1
SHA51296bd727458bcda9a1274faacb9eff495e4db50acd1f48c7098635f27d0932d423a1be9b49b3f1b622305a8ac46c01fcac6e5077d2b0d9e3743c760b1682d0b58
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
1.2MB
MD5fc70f5245ca63f049b9f2c530fa6f05b
SHA12b18970a9264980e2cb3d2fcd65d6634c1a5fbc3
SHA256be4eb9e3757dbed4dbbfede189d8d92456508e52fe8688dda661dd120be76a88
SHA51277bb325184cdf3acf8492b4e47507d1d2175e428f66a78f5b48cacac8b9d7d1a18790f3d899361824399abe4c59f514e7c982879f06c9bbc3a93999f4572ffdb
-
Filesize
1KB
MD5a2cc006556da01a2e1e1d9262e4a2254
SHA1fdabb761c79c8c6878d5c83c36225bac6beba8b9
SHA256256a133fff0463b18271be28e780918f720e2653b1217a88a4bf94b054dc4206
SHA512fcc2fa4fa0c94e95b6232256532794b432e426f7573ac024977939790875018cacc7d9af24a56eb9f38c72e94cfa4b8e998b5e6ecb63285a2a91a7fb52c4c9ad
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB