Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-08-2024 15:32
General
-
Target
93ae5f6059247d99d43a26e7968f6553_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
93ae5f6059247d99d43a26e7968f6553
-
SHA1
725d664d5358124d996b425828f6f1412e9cb7e6
-
SHA256
f11eb150d3899616f4e6857c247bf09496fefc2f44d9badbbba02b85dedb8f9d
-
SHA512
01755678f491dce52317eebf5f4f48dba124dddb364e3ef97174f4bd42d2410e00737ba3d429302a7b1964d0a6ed845cb96ea10fc280d2aa5b0a1584561f0ada
-
SSDEEP
24576:4uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:I9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\93ae5f6059247d99d43a26e7968f6553_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WMPDMC.exeC:\Windows\system32\WMPDMC.exe1⤵
-
C:\Users\Admin\AppData\Local\ZNx\WMPDMC.exeC:\Users\Admin\AppData\Local\ZNx\WMPDMC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\uZ6ttVjJ\rdpclip.exeC:\Users\Admin\AppData\Local\uZ6ttVjJ\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\iLe8dUO9t\slui.exeC:\Users\Admin\AppData\Local\iLe8dUO9t\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5652e6330ab9063335b93b91038da6a43
SHA1c63560896321e58684e83dc79ee85dbf30979b1d
SHA25623fbfb6501dae5a7011960995ced849764204e98f606f52e1ae193335c71beb9
SHA512602766efc1337ab80e00bcc346beb290203b7c7714a4165420c86fe849da05a4b20f08a95cf2dfb1b06df44a7f6552038d846368e3c30218ba2a37b82fbaf428
-
Filesize
1.5MB
MD559ce6e554da0a622febce19eb61c4d34
SHA1176a4a410cb97b3d4361d2aea0edbf17e15d04c7
SHA256c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba
SHA512e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18
-
Filesize
1.2MB
MD5c4281f8a8fa825ffd33003d12acf39da
SHA15bd4ac4a691f4e4f006c46e3f2b927e56ae880f3
SHA2568d12996b3a4bd80585ec879e03e584cbffa05527c8187104af74e5c6deeed5a6
SHA51214ece63da71401e4cccf4ef194bb7fb315bae5b87352d1db07d5c4b19a43bb86f22bdea290fde765b97d184c66358ae5e3fe38a882dc96827982005904dd01b1
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
1.2MB
MD52011ea993247e0645f02ec32edda8aa5
SHA126ec2da4893cb245fb9a8dce7de2c63c64405921
SHA256d8d01842eaf545d94c5c1401389487513e1235f024135b01c5b15f37341a23d9
SHA512635ebb7f409ec3ee6876035e6953fa3b4c622a04c8ee72af9d9aae1fe19fa4aa58c4bf376d3740da54c845c2bff8e6c7b1577ac8f6168efd2d97b3d0040df6a0
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
938B
MD542af50b445b193d3613284766149177c
SHA1554ec1e7f911a1fe49f7402f4666ccef5ad6e7b6
SHA25611ea822ba4b6575c6681c914a23418279c8666a8b6d118154c57feed7bf0298d
SHA51243738dbd0f5fd641c8f23799be1fcd64179b111a8e86e04963dfaa9ecb7a2351259e8bb2933145201fadf8bae98d0cf4274552af488c450294217c3bd23988b9
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB