Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/08/2024, 18:53
General
-
Target
9451d3c0720234ff8d9c569a4aad8091_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
9451d3c0720234ff8d9c569a4aad8091
-
SHA1
93bbf76f507f8cb828ce56565b2c49f24cdc833e
-
SHA256
563a650a72c772c648f6b34055b1d31c379fa7beef40d6eba02aa25b5a7316d2
-
SHA512
21682d7762390f1504933c3e1a978d806a2334f43f5ac6d6d2c575bbfd950c1dc8eb8b4cd4216a893f23b3cc814cbe48e6e493c5da6cb998960a19edce17f88d
-
SSDEEP
24576:quYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:y9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9451d3c0720234ff8d9c569a4aad8091_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\1648Tu3\ddodiag.exeC:\Users\Admin\AppData\Local\1648Tu3\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\EgKXkS\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\EgKXkS\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\po7DInOS4\msra.exeC:\Users\Admin\AppData\Local\po7DInOS4\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD55e6e254a012278632bc4858d99c577f6
SHA1d43d818672ebf97ec83a02be54694e1c99821fa8
SHA25649d49f3d3a6382f70c4c3e802b25c9a6ae30a92bc23d91ccccf097388e8b50d7
SHA5124b269206481876b7f0ccfbb8ff7d90f00bfaa8487a6f3973107b951d10768f033854af336cb2ac44786fb90ab078a1a53bb95bbe6b059c6b8e3e37ae840c701a
-
Filesize
39KB
MD585feee634a6aee90f0108e26d3d9bc1f
SHA1a7b1fa32fe7ed67bd51dea438f2f767e3fef0ca2
SHA25699c63175504781e9278824d487da082da7c014e99f1024227af164986d3a27c6
SHA512b81a3e1723a5180c5168cd7bb5181c631f4f57c59780bb82a502160b7874777f3eef1ebe1b14f66c97f9f1a4721af13b6fbcdff2045c8563c18b5d12540953ff
-
Filesize
1.2MB
MD53c56d5d99e98863f940bb5116f877abc
SHA12ec6c08dcac5e64bcc594be7a2c51fd221597bac
SHA2564bd4b4ffc521b87c991dfe846790012c5abb6520b3a0d58891115c6d028011af
SHA5127591ebfe6fcd030fcbfd6582d5a320da29b0b08adae0e2032a2bf7358fc969355c32c95c662611bed7c23f5786eedbe50f9307f6f0701930eb24efa788167a3f
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
1.2MB
MD5b49711c305ad1ac1f4bdc67d5a3a8eff
SHA12676306ddf74c6d86b444eb0a42b6c3b0444976b
SHA2566c37a36dd0f3e400252328360e678dfd8f1170deca5bc8f39e8ff1910b7aaf85
SHA512011f7747359edfebc98235bd016f72ba79a014bb0acff3042789489e1c24faa4affa09ce831749f71b5b78e0358b478d62229842cc34bd4e7ae4fc8137593e06
-
Filesize
579KB
MD5dcda3b7b8eb0bfbccb54b4d6a6844ad6
SHA1316a2925e451f739f45e31bc233a95f91bf775fa
SHA256011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae
SHA51218e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5
-
Filesize
1KB
MD5012a3ed5127a23d3f541f58ce587e727
SHA19402d7114658f08bef6e4cbbfe41f210884c67ae
SHA25631d1de71941d2c17d18e73aaee7d24cc6dd104bd21a3d0ede961677110e3db14
SHA5128c7f13fcf43da57eac61fcf908dd7a4d654ea77236ffa266a4a5a66e948fba96be2fcbec0d260456262bc1ef1a1e8b698f923612e4a242a991f1c5d0739628c9
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB