Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
30-07-2024 15:40
General
-
Target
7800b9d0be9bce9e13706e9a738321cc_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7800b9d0be9bce9e13706e9a738321cc
-
SHA1
6e4efb0b9602f6400ae735dc734f94faeeaede35
-
SHA256
d2f5888941801c183beb9683356f780eaf0b66a94b595a8db0a52b32db5034d1
-
SHA512
dbb62a792651abc3f2a5d2a689f52c58eebdd7c6f448d2f10579f961f6691ef3e37079afe81dd52580cbd2aa2bb02228a06240d8aca4e83667c66c1e6007c68a
-
SSDEEP
24576:HuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NXwF:p9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7800b9d0be9bce9e13706e9a738321cc_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\Bc2xSrB00\isoburn.exeC:\Users\Admin\AppData\Local\Bc2xSrB00\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\W0wo\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\W0wo\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\jRPsN\MusNotificationUx.exeC:\Users\Admin\AppData\Local\jRPsN\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5552efb84fec9046f1185030fa698eefd
SHA172e5ae3ff09faea8b19f265a615874b4dc3ed65a
SHA2566592142924317425bf8f7cde5da13e72a186efb31f918d63bed1141007b286bb
SHA512a0766912952540a70403939d1a56743c71a0bf509650fa7aa6baff8bb78464aa32fc490196e6b2b0b4706c67cefec0c784acc0edfef0c69ecd57688aa2e41426
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
1.2MB
MD53225615a65cc11ac2568ab4b7551c4e2
SHA1b7f6128a9acfb3c5874c57b1a1db84ffb4321f6c
SHA25660d091f15f4d8e6202a7cc0fc576c8c389e815a8a3bf9a4775856f4d3bba2c56
SHA512b3d1be36546c6ef3fc11d0507a2e15d576606ec93e376d351d005fbdabca71cfb161d4051a5b928fdca2292cc67b00681b6d188a25c23cb4f8d9bd7320d2d71c
-
Filesize
82KB
MD5bf5bc0d70a936890d38d2510ee07a2cd
SHA169d5971fd264d8128f5633db9003afef5fad8f10
SHA256c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA5120e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.2MB
MD583aff1a2bb0688c94fc4f1d45d43ca18
SHA1fe8eff7daa14e8ea51df30de2957966c013ace18
SHA25602c1d98f7c39a76253ea55b2f7c0b84e726be62acd0d77e2ff85a9be40e83429
SHA51298bec2930627103f7b248d73b0ab333601a129e8478e49b6c7b464d73389270702407dd3a08be18a797e78b758b86e471fce2259eecd40ae35035456b7b0fa87
-
Filesize
1KB
MD551a2a90c7f0d5ff64f8af1465fdf0f68
SHA12e88c25c3e1d2fc1fb972ce2d7f201fa8c9a8233
SHA256b0fe91ae18ba5b256adc67f9796befc1ecf70f3c9514ca23087640f1176f717a
SHA512fd2739940e7a08378c4a63db3a6bfabd4211afd613550f40413e96c7037b87b83492b6d6bf7d43935d70ac62714564e45cb5813c31966a6c24a1006fda84880c
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB