Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-08-2024 03:40
General
-
Target
9178704734b911ca29d7dc5c900578fc_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
9178704734b911ca29d7dc5c900578fc
-
SHA1
0cf6ddebd252f71169e021735ed2cefa724ebd12
-
SHA256
baff5c31fbc24802e6699a7b10eb759d7555eb590d051c768980a2fafbf4265c
-
SHA512
9fe6a6b935c4cae65dbcaef7bd292c4a2c7ad47ee83db4b5abec59a7cda5701521493f66aa0f0739aadb1577c54e431f3fba153bea54fae0a1c9f623a6ab6891
-
SSDEEP
24576:VuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:v9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9178704734b911ca29d7dc5c900578fc_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\Vi1VQ\dpapimig.exeC:\Users\Admin\AppData\Local\Vi1VQ\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\K13vM\mspaint.exeC:\Users\Admin\AppData\Local\K13vM\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4ushowIE.exeC:\Windows\system32\ie4ushowIE.exe1⤵
-
C:\Users\Admin\AppData\Local\IRlfJ6G62\ie4ushowIE.exeC:\Users\Admin\AppData\Local\IRlfJ6G62\ie4ushowIE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD583ebacf145a040b981094dc698d989fe
SHA190d870ad895780ce54e4632e4ab3ce74b446d66a
SHA256ae3332d574203a05fc727196842885616d357da4d3624e4552f48eefb484c6ca
SHA51272040426ff32526c4bf08e85774d63f4144773980188401d69bbe1f9976280ef600294c58c12cbf7586a2cfecbbbc0f5032ffe69f6f7ab0d6681da4f23cee0fb
-
Filesize
76KB
MD59de952f476abab0cd62bfd81e20a3deb
SHA1109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA5123cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9
-
Filesize
1.2MB
MD598651635d6f443d2d66fde5e56b17c1e
SHA150663c076c010cce6bebaa6d4440dddf07056017
SHA256cab305cd2ab0867ccc22bd03a9b1a8f5008d7c29e7f786b1e69ce5ee121cf949
SHA5127dcd6a0fa8861f66bce1cdef96fc9064b7437d6160c9d57acc8f0eef5041188ba629279cb124091fd4da006566c4e22598a11cd94650794a576a9a9ebd41aa4c
-
Filesize
965KB
MD5f221a4ccafec690101c59f726c95b646
SHA12098e4b62eaab213cbee73ba40fe4f1b8901a782
SHA25694aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709
SHA5128e3f4e4f68565ef09f5e762d6bb41b160711bbacac9dfcbe33edea9885fd042e6ce9a248bfcc62f9cffdb8e6bbe1b04c89bd41fcd9a373a5c8bc7bbff96dceaf
-
Filesize
1.4MB
MD5ff407aab3088a76e4d3f647a162b385f
SHA18ab7c7a7b829871013e7bdeff7ca0f547ac87d24
SHA2569aaece9dc7e4dfa3a57bacc2c6a1db9c8e4f792e948cb6498c37a1ae557d53e5
SHA51254cb8fc437ed7c2c4a2e6cea5d9af87b1279cb0e8b207f630d0a5f318f45267226e25743feffa707bd6fe383f049c694379dde997b7f4cfe4ae07c34a91ada9a
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1KB
MD56b80cade142da1bb4bc6dd34d024c44a
SHA14a9b158ec2a5d921186f2e3c20e9ef6568f1cd02
SHA256845222d0ea6851b4d5320d38da54bc4eb41f9ab37e1960469689dfe140111463
SHA512e33e21892447b215d06d77df62293d9ed9474330eaea40fbdd440d0dd5ca61d797e2096f1456b00ce375a7796519467a1061e524f5cb61570fd45abb483ceea2
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB