Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
30-07-2024 18:39
General
-
Target
799a60a13199faa45a6c016aa9721706_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
799a60a13199faa45a6c016aa9721706
-
SHA1
c572d26d09ad7f652f1327e3a3c2caa8358ee55b
-
SHA256
7c708981d426ade7e53c8627a4ae6994591f2ea2787291535cf782aefbd588cc
-
SHA512
c8a70ac097d28c18cfb1b0176d8c45323cd0752f7d9076196bf62b123fbff62896aba4052d687dab27e4aaf8d4fe7d9487b05bbf308e385adfab2533186c3356
-
SSDEEP
24576:iuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:q9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\799a60a13199faa45a6c016aa9721706_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\iMm0\OptionalFeatures.exeC:\Users\Admin\AppData\Local\iMm0\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\mI6P\LicensingUI.exeC:\Users\Admin\AppData\Local\mI6P\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\mmWVQrBl\SysResetErr.exeC:\Users\Admin\AppData\Local\mmWVQrBl\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
1.2MB
MD550f84c31425bbe9f0d9ed1d9e42c8c35
SHA1b98daa35b1d8b46663a1e6bf80728b7ae2f304f1
SHA25624d28680163117a3705671dcad5a24130669c5ab122fe887b0c1f17cf787f514
SHA51287cbb33e7c97021b05088ccda341c79afbeefca79b2f5f3e26c876f8998628fe7b454fcb53356ae618193d0769b08bc262c77ca580b22879be1f54a72e19d7fa
-
Filesize
1.4MB
MD5e81412d615e4695e9fae4ef910197856
SHA1a10f3d96104aa5e2798e1bf9face9f4d5d9a4852
SHA256568b03707b8facaadc54cc2eddccc1e1ce308f7e594f69bc3530ab0c198a31c0
SHA5128ab3997cd3e545697a81fa4f8687417d8330c35da786e7d45dcaee5a9bf918d7c62405df67f2edce16461520f9814e232cee8fd810173b7213ba656878b963c8
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
1.4MB
MD52b3e9dd99598c926c713dde38e665903
SHA185d4486cec2c003b53370e64f3a1862e40d09680
SHA256a95152d93dfa30ea3b13128d92e7a7993eaa74e22a1269d3d7bb498bb03d3874
SHA512231b78a5b0f71fb37437753bafb843f49c5be4610064c824c9945bded759e614a68f8d72248e9c18c1fcbe63a4386ee1cd5a35f997ac98aa9289782ed4f798d2
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
1013B
MD57d8e1fc1c8fa81cf5ef96659cadb22b8
SHA175a00574049f87f1a6663645e232bc884920c7c2
SHA256fa4d8ce553939fa3d189dff768c0cc2a300a04d0e7423d989bf512745f259943
SHA5129f90bbe72888f2a3f4f0d8f92c86f386cd7f5f00b18a0cb288a7b0cb262f852328c3b60608dff16644dd5c4a3868d50df353d3cc4c632ec7a3e840e508068823
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.5MB