Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-08-2024 23:57
General
-
Target
882f81e1b065d0ee8b1f09e3c0cf5005_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
882f81e1b065d0ee8b1f09e3c0cf5005
-
SHA1
d0edf3240ba31504894f85af5f0a3cb3d3fe1a8a
-
SHA256
a6691293ad0620c03ad88d76e5e032d56eb2101dedef76253168e8555eb37514
-
SHA512
4c89e56f9f8a583601d6f9dd815a4aa7cfbbff4be8cfee2b4ee8f2ff3af0dc9c3ca3bd955ef1aca1d1b979e5aec6e7b1aa3304f1be2eddfe55cd6ba41a5a5a06
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NSt:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\882f81e1b065d0ee8b1f09e3c0cf5005_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\nIe9U\msinfo32.exeC:\Users\Admin\AppData\Local\nIe9U\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\LsTyaMt\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\LsTyaMt\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sessionmsg.exeC:\Windows\system32\sessionmsg.exe1⤵
-
C:\Users\Admin\AppData\Local\DKpJrZ\sessionmsg.exeC:\Users\Admin\AppData\Local\DKpJrZ\sessionmsg.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD59f7c3e396cf270c655155a462543e39e
SHA19bc1a7739eea6d88db81ecd1c959c152f8f7cdb0
SHA2561168f92bcfe9c103d045e78d914e5df3a44c9150e627a4b8ec93f2e505932fd3
SHA512d427649afef756782ec4eebe1fe8efd99157db46dbde309df2b726d0ce89d870018b177df41716992768245001b1233ed21d68f85d47db97ca28a8fb5c141489
-
Filesize
85KB
MD5480f710806b68dfe478ca1ec7d7e79cc
SHA1b4fc97fed2dbff9c4874cb65ede7b50699db37cd
SHA2562416cd4aa577dbb2f8790a61e36fbab2b30bff81a4e1f67a5151c2fec29585bc
SHA51229d3d234ebc45049a533b6a91b246ac043a56b9af67276aaf493b014ae34d73000f99a6b0c0b85d2dfb7fba54811cf8bbdfd167a9eed01a8617b7f05bf2971db
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
1.2MB
MD565ce234372899902bca056358ca75ebd
SHA1cc344317fd8c08f0900c7313e5e75dc93e55212a
SHA2568f35ff92c2bd763f069e67cf4106385135c1b479876e16c4a6c93c844066f3d8
SHA512e72f32763ffe08238d4b772fa45ca8446743595bcd96dea73a01fc28040b88999129b3995822bd766ca52f5c916c294efa12718a633c6c661f43f961e97cec80
-
Filesize
1.2MB
MD531d6c48f2dff45eaa440aa18f7696667
SHA184f01f9cfc746fe71b2e599478f9ed3a4a41807b
SHA256f8aa4d2d1264144dfd8f409a03e2162f876700cae81e8440fa0ab8ea736d2bde
SHA5126ae0b3f6d3f5735b94b02535557bfe6e1be8ae158e60669cebac68e9b7d6e14672af60fb1852532cf07071fcd2db7870d41d79541498f158a83eb1b0f79521d4
-
Filesize
376KB
MD50aed91da63713bf9f881b03a604a1c9d
SHA1b1b2d292cb1a4c13dc243b5eab13afb316a28b9a
SHA2565cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14
SHA51204bca9b321d702122b6e72c2ad15b7cd98924e5dfc3b8dd0e907ea28fd7826d3f72b98c67242b6698594df648d3c2b6b0952bb52a2363b687bbe44a66e830c03
-
Filesize
1KB
MD5deea4ede73f1eb4e63bd84ca878d4d46
SHA1861632ce20c1a42a66230cfb4c904af8c50e88e1
SHA2569e7d5e27a6e2904cfd0dcaf0f5660650b340515cad1498f839ca42d27a9d570b
SHA51237b259e20c4d33038886d84215369dbca906fdf91d4954e4763a32cc7281652ba7e59993ccd2cb763dcbc6364e683964641bae002c024fafd4720d6217b1e785
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB