Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-08-2024 04:32
General
-
Target
919faabaf40217b576a1f93cab032587_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
919faabaf40217b576a1f93cab032587
-
SHA1
846b9da7874bf67d4ac2c506113852d2d65b363d
-
SHA256
c1c7e9180c08d543ddb651df2858b8d84fe6964012ba3cba206d3d025db49e36
-
SHA512
724addbbc986ecb110c698cdd916c8ef00d6e28d509533d10793c21476fa39c0e371ca7032a9a0cf4a5bdc80728e1221377c84b09d7a577551dadeda30b409b5
-
SSDEEP
24576:KuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:S9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\919faabaf40217b576a1f93cab032587_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\Ibcw\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\Ibcw\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\WSTCfYPE7\wlrmdr.exeC:\Users\Admin\AppData\Local\WSTCfYPE7\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\U4xMxKRzM\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\U4xMxKRzM\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD594d254a26b8a0b58d8fda9593e5e6d82
SHA168a2dbf69bfd6245d170c45a4f7e17899e8d94ac
SHA256ec29a655c3a70ee249d3b4c786548cf495ced90bbaab94dbf964457e9a05f951
SHA5125a53eda3f25ff80ee0d72550ce7efa1b5486cbeefa6a954e2dae84a3a23cfdd2d1bd2a82f4e2b5012b909ab0024376f149a0b4b6ef08215acc567f7a05f30da1
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
93KB
MD5d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA2562adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA5121191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f
-
Filesize
1.2MB
MD586fcf57438295bb3356e13afbb9209b6
SHA1ebc52f86e4cd1f18d0ef6f4f7f59b09ade52b9a0
SHA256b8cb90766a7feba8d113536a252daa29b9bb3190b1cc8f2138979f8af6220dcc
SHA5120f3dcc0c2ca682d07c0a4650ea342400c6f4baed97dfef4a165efb06628a19024b054fe5365bf90cb0ea1d48204c613cfffeab616af66ab17997171d9e4dda14
-
Filesize
1.4MB
MD561117cfb7e56ed36d6cfa90e2eb7c9a1
SHA1250911ac7b54403d1acadeedb0740458a8ee2d58
SHA2560349fac70dd20f7b4940a2db5bcb35da4fe9bfc4fa1d8e28cad510f99579c631
SHA512a9eeea6684dd39edb3dad9951612916fa94864fe5ee1a6dc06a9de6b6142c4c43d6dda39dd70f8e223bc6b87e0109601d687e42cec27ab91f2911806577845d2
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1KB
MD591fa6c335558a6f432b297ecf4e116cd
SHA1ef6d097be68ce6cb0b9a84a1a6590e52c5882586
SHA256057c36c6ea37cc6a65df8dc0d8d73ddbdf17d5077af324fcddd8f473761d60cb
SHA51223529ff9fddbd0007553db0f055fb06b29c52cfe8c15cb9b2ccf3d69676987511a0f838b1f3d33455aa9b51b382addc8e91bac904edda6d864f5433875e52708
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB