Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
30-07-2024 20:53
General
-
Target
79fe22837f3351cc4c4734412120ec9c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
79fe22837f3351cc4c4734412120ec9c
-
SHA1
85bbcddc95e1a7bbb460f48b44990406d8ae7105
-
SHA256
c28471b6d5b4dfb26f7cc16f94d090fee743872676ecf36458a0f86ffd1d0a14
-
SHA512
cbf2ebf4248aa17ae04768c2b855a513ec07adac6c713ef9105a9ec0ef1b535258d08823e1e57ce4ebda7acca71e5ae23200e5b0a40779debffb9d796b1f45a8
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79fe22837f3351cc4c4734412120ec9c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\lP9EE9Ott\CloudNotifications.exeC:\Users\Admin\AppData\Local\lP9EE9Ott\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\ZuL\MusNotificationUx.exeC:\Users\Admin\AppData\Local\ZuL\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\qP75WjmLJ\wscript.exeC:\Users\Admin\AppData\Local\qP75WjmLJ\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.2MB
MD5cd1ced7c5bc80672835516b64516aa2a
SHA1f8e41b3a2e52291b885eb4cd7662da4448aba8c1
SHA256db87a86579b7d47970c5948d09b995b64834a0bca7eeebea3a9803c263c1b3e5
SHA5125709f657d5ecfa2ab8a54c6cd5a78dce54e9c75bcc473b5f5540d98fe47677e4fadd9e41f3d676ea06675f3c72b92a58819194e7ebf38b50cfb993f3adec3319
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
1.2MB
MD5b091db7c06b6d442b6d01568761ddeeb
SHA1cd3c4304973b07b5a200d3a26bdc8c3eed3f7462
SHA2569c189c62cf52d9ae459e0bb20409359b754a1e7d8980e91d6a0b2274ff945636
SHA512b3ec13fcd4dc721b8d0ed2e3d70a3a5380ac012bce2c012b79b03ba7aba334ebf5d6eceb80190f84919b45df91c1f7943a4c24adc2c83ff324bccb3c1368b4a1
-
Filesize
1.2MB
MD5cebe1fe110e3c862306ffd1a880f5cf7
SHA1403da9ff824be3b27cf50397e03b3c7da8e39866
SHA2563a80baa8ade9894b1dc7757d1f1f2ab6f0ec9699082ac36924a0a2d6c5878f11
SHA512f16b30ad9e1547465612116b2b37dd3ff4616a664445b4bcc9476b9095e9eb26a476841e592be878713ee6b9f3e610afa0ea6cac94594470e577233a1337137c
-
Filesize
166KB
MD5a47cbe969ea935bdd3ab568bb126bc80
SHA115f2facfd05daf46d2c63912916bf2887cebd98a
SHA25634008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
SHA512f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
-
Filesize
1KB
MD516351263a4fb005cf17186fe6cae70c7
SHA123cdc9b7ce3990efab895f534c1f623423cb6cb7
SHA2569cf78ac7cb6a4ea3655f9bc0b11d965fcf4101082f0932d5fda8c86ff05a34c8
SHA51288dc73a2ce9b2451cb6344e653f9924110e62512f4c564eec2213f59d90ebeb887351778aaa0c17de703b61c86081ac4fc10f70895e18ad685b25c18a96440ff
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB