Analysis
-
max time kernel
149s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-08-2024 08:52
General
-
Target
8e19a8bb88b3a6f49c0280001d3d9048_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
8e19a8bb88b3a6f49c0280001d3d9048
-
SHA1
c50c2ba966058ea5951583dbccd7b89fbeefad55
-
SHA256
568409d2fe2b02aff5e1b17110ae744f95d9ec7a4f4f977026585845e2b428db
-
SHA512
dbf21ae29251ca3aad7f084485f6f2362b03dc4cdbccc5f3d0566c37bb949537202638c57476f83b98f913fd60754e14dad052059835907ca177e41f3317d56a
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e19a8bb88b3a6f49c0280001d3d9048_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\XhcVq7vx9\rstrui.exeC:\Users\Admin\AppData\Local\XhcVq7vx9\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\UyZdA\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\UyZdA\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Users\Admin\AppData\Local\ia9VB5d\RecoveryDrive.exeC:\Users\Admin\AppData\Local\ia9VB5d\RecoveryDrive.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD512e7922e4773c12f1484516b9ee4f12c
SHA14fa476d11a0ac10103954d1d333eb2ce442fb09f
SHA25699df445627c5183d66bdef4343f032abade65754ea6373e1ac4229c9633cf4d5
SHA512fcddc752235718fe218993bb4647daf9d00ca5b9427d055a1b272618e18883ebf8b397f653a18890ab0e2f115eb5529e32fb4e700073538c87a7954aa7a9a645
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
1.2MB
MD533fd63123bd7e8bf9cca7a1ed38eed8b
SHA1cfcb1d7dd4ae29de228c959ee1971d0703349933
SHA2562b3d46164c8fd18752efd431bdd685333d1bb7af1a83a0a8a8c0629b24d25565
SHA51281ebc317f7afc4176786cbec33d28c06e1c329e46ba62b15f98aa570f1fd1f48f3485d02ff61436d8c1533b664d6e5b14ce9ef2bfa858709bea95dd0af54f305
-
Filesize
268KB
MD54cad10846e93e85790865d5c0ab6ffd9
SHA18a223f4bab28afa4c7ed630f29325563c5dcda1a
SHA2569ddcfcaf2ebc810cc2e593446681bc4ccbad39756b1712cf045db8dee6310b4b
SHA512c0db44de0d35a70277f8621a318c5099378da675376e47545cfbfa7412e70a870fd05c92e0d6523ea2e0139d54d9eeaed14973762341fa3154406ae36f4ce7c6
-
Filesize
1.2MB
MD5907b757aa9b15c16a32baeebe530df9e
SHA15331847b5f366c6027df6e161fedbf08f2491315
SHA25686132d8d283c5d39ef774b847274f75c637239e6b0e29609623a96b2ea4454f4
SHA51256408a4f606773c2087169c63fcef4509658302b4b700facd3527181c204605a562c75c7a75313577f933420bead4b8cb6ae96c22c47b4ae27b08d4849756996
-
Filesize
911KB
MD5b9b3dc6f2eb89e41ff27400952602c74
SHA124ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA5127906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe
-
Filesize
1KB
MD5ba7abe6bc9fd6188d6a1161d2e58cd04
SHA12150bf0b3ac5086375b2100d7b735f299f858f1e
SHA25678d0e7ddb3728bdb9527abebe50e49e50f28ef1e6a9b0fb1fc901817612c46cd
SHA51247b296353ee60b9d082e1dbf30ea78622a1ed94f2c91ef87e52fe1f9d585426dc9121275357dce6977436182c342365c572a143416bee843962721a1fbaf881b
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB