Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-08-2024 04:58
General
-
Target
84e153b09cdcf94c51fb28dd948c40ce_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
84e153b09cdcf94c51fb28dd948c40ce
-
SHA1
a62a91ac31a93b7e788388017017dcaddafc2c50
-
SHA256
cae8edf96ad41267994ab6e5ed6831a50acf695c3a706f4b5fa0fbc41d9efc6d
-
SHA512
23fbe66b8768326e23f657d57e6643e38dd19d137c42594fb73c946680b3114871e20a1695fc58c979fe1de77f0eba4f9dda97c76828949a93d1cc24b306ac85
-
SSDEEP
24576:MuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:k9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\84e153b09cdcf94c51fb28dd948c40ce_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\bO9iI\bdechangepin.exeC:\Users\Admin\AppData\Local\bO9iI\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\ehsRAqfF\SysResetErr.exeC:\Users\Admin\AppData\Local\ehsRAqfF\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\vMPPH\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\vMPPH\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD55b708e393b74ffc6b424bcbff1b2cb3e
SHA1a4dc54407d05a3cddd92333d0a6b7d0002a5ad5c
SHA2565df14e604ffa804ae1cf8972c14bb524f0a0b9077c1752c847d91a53bae8fae3
SHA5123872e5a3d523e2a3c0b2eb3d803f455bca620c37a58e3f9c306f6b46fa94d375e2079fae3c65344d15b54fd891a773b8cf6daaa566c55dc22a41256f627a0bda
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1.4MB
MD55b00c698bdc6b0c57e90293f51c0f893
SHA1990742dd393caf7bbec99a8f5e0140a6f432a2c4
SHA25654f710b8b8a5463b5b5702bce0bef9b45fbc8e03a8ea762faeff8fabb48bfe2d
SHA512066c20bbde8528fa627e8a029d2f805f5aa8e7b39ea8ed725b83c7ed88eebd2821dc07c870fa569144979b751e9427b7471e3137892cba4c69842a2efefa378d
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
1.2MB
MD5f3228b9b198f3f8f4c3cc9a7db905008
SHA10b32b8c10704604730574c1efd5a4ea576bebaa4
SHA25665224bfdcdb298999cfe1c2573a7eec9bc2359c9fe31b00023a4a82fd62801c8
SHA5122c55ec09be3d8a7fade7268304696163dd295ed075d1f0a2ae950c901d026e27db12a07668aae58265ddc86348f60db646c9392122d891b62ea457049df4d331
-
Filesize
1KB
MD5cdce8d2a69f76b1a9fec9909901940f2
SHA1514571e3164da445ca4bd95f4c5ce5e9b89dd7a5
SHA2563f12aa3d56a4d0fa40b2f287791c8fc3ffdc5fa6c5abb8bd16ef62cafd7b55b3
SHA51296243793d7c824eb5845712f4dc1f5b987148454484f71a1d7b63f9778080f333c7d3956362dc11d33fb96b9dbe5e20786e93b3c0c0cfd8f51d294e00d854477
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB