Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
13/08/2024, 04:32
General
- Target 919faabaf40217b576a1f93cab032587_JaffaCakes118.dll
- Size 1.2MB
- Sample240813-e5z7eazakq
- SHA256 c1c7e9180c08d543ddb651df2858b8d84fe6964012ba3cba206d3d025db49e36
Malware Config
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\919faabaf40217b576a1f93cab032587_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\Ibcw\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\Ibcw\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\WSTCfYPE7\wlrmdr.exeC:\Users\Admin\AppData\Local\WSTCfYPE7\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\U4xMxKRzM\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\U4xMxKRzM\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SYSDM.CPL
SystemPropertiesRemote.exe
DevicePairingWizard.exe
MFC42u.dll
DUI70.dll
wlrmdr.exe
Mihblavoyj.lnk
memory/2284-51-0x00007FFA0A0D0000-0x00007FFA0A201000-memory.dmp
memory/2284-46-0x00007FFA0A0D0000-0x00007FFA0A201000-memory.dmp
memory/2284-45-0x0000020BACC50000-0x0000020BACC57000-memory.dmp
memory/2508-65-0x000001BB2CB50000-0x000001BB2CB57000-memory.dmp
memory/2508-62-0x00007FFA0A090000-0x00007FFA0A206000-memory.dmp
memory/2508-68-0x00007FFA0A090000-0x00007FFA0A206000-memory.dmp
memory/3504-28-0x0000000001000000-0x0000000001007000-memory.dmp
memory/3504-4-0x0000000003010000-0x0000000003011000-memory.dmp
memory/3504-16-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-7-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-36-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-6-0x00007FFA268BA000-0x00007FFA268BB000-memory.dmp
memory/3504-9-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-10-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-12-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-13-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-15-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-8-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-29-0x00007FFA27730000-0x00007FFA27740000-memory.dmp
memory/3504-24-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-14-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3504-11-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3600-79-0x0000022862C00000-0x0000022862C07000-memory.dmp
memory/3600-80-0x00007FFA0A0D0000-0x00007FFA0A207000-memory.dmp
memory/3600-85-0x00007FFA0A0D0000-0x00007FFA0A207000-memory.dmp
memory/4236-0-0x00007FFA19720000-0x00007FFA19850000-memory.dmp
memory/4236-38-0x00007FFA19720000-0x00007FFA19850000-memory.dmp
memory/4236-3-0x0000000001F80000-0x0000000001F87000-memory.dmp