Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
31-07-2024 06:13
General
-
Target
7b85a378b5aa0e00ad580ced76cf24c4_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7b85a378b5aa0e00ad580ced76cf24c4
-
SHA1
0252c8d455476716c277a75f0ff0846f0ffceba5
-
SHA256
01ff8188c74308b5694f1f5417b8dc8a2c5ac2fe59b4b10d792273dfd00c40d9
-
SHA512
79811bfd3cc4afa16bcfb48a2ced69b540b0bb710b6d4a8e0ae2e4e2f0c1349940248ca35ed485254c0e675e2925f1e7a5a2f190ac83cd00daa3ef5d64deb6b2
-
SSDEEP
24576:auYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:C9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7b85a378b5aa0e00ad580ced76cf24c4_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\wty\CustomShellHost.exeC:\Users\Admin\AppData\Local\wty\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\nxiaA\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\nxiaA\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\EUQPFLh\Dxpserver.exeC:\Users\Admin\AppData\Local\EUQPFLh\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
310KB
MD56344f1a7d50da5732c960e243c672165
SHA1b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA51273f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65
-
Filesize
1.2MB
MD540624d4c41d3dca97f9f35e7630af4c7
SHA15678113d465694aecbda1cfbea6f72fe735a282f
SHA256635ddcf1bcfbca5dc8612d7ab7ff192ed842b890641068db14b630f518a9d2c4
SHA5126abd60287c6970c9be4d3fa59e69903f3af3382421c5841633920485191554938f357427bf7f19588f683efc03a37a3aea9b96b714785419d5c37c0fd257bbd0
-
Filesize
1.4MB
MD5adb16bfaaf8aaa1ad7a41799eee69588
SHA1656c30d67cd8752b4ea4131bb53c6154e8de8768
SHA256fc2ed3fb6aafcb9f5ea5d3400c53b26b8be06dce4da13e6e51535523a783cd57
SHA512fcc3d4d0407a00f610bf4e649bd8522d465dce6f4f1b48975dfc8da45a6b08655ec24e2f0db069d7e30b8febecc511f86820a11ce2e352d25ec7cacb75a36f9f
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
1.2MB
MD5d0659d9c565b5736d499caf62e989dd8
SHA1915a16930152f21a01c6a3189f30e32cb3f3a793
SHA256cac717495c0ca765255fd4d811fa8476dee1f7c3a87256a1368a1fdb6b48b861
SHA512e88b6911fb27546d0a202dc9756aee230649aa382a2d4f5e43733764c94fb337be52810603658b03b271cb69ffd01d5eec81ad3dfc96fa606e48442aec53ce5a
-
Filesize
1KB
MD55e01d51bb71ef2ef57f327db8753a916
SHA1cd8e75dbb5bd4edda89a5b29b64ae785d014c575
SHA25632293e4e50c21b82ce591adc3c1de570fcb3f6270a20f298c893900e17224e82
SHA5129902d4f1721a2af836eadb6dfa5279c6391dbdda70d91715cd57607d6b401c66c6eef30d28855770fa7a0df890111760b722c9d39bc39fa7e62f200174097129
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB