Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/08/2024, 19:43
General
-
Target
9479aa71f97c0fbd162719ab490fda2e_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
9479aa71f97c0fbd162719ab490fda2e
-
SHA1
4f043465c45e51d782522abee19fd9becd6b166f
-
SHA256
93a7f33ada113348eb0f47f7ceead4589b4878c7408e91f95691d5c5c68ceac6
-
SHA512
a52b69cf5e118c3ea7bfe4e6e818cd878616012153ca1d3979d449249ede3f12131f4cf9c862efc2f46c3f665672eb5d130b00336935c41dd657c813bd1b9c91
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9479aa71f97c0fbd162719ab490fda2e_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\jjG0cj\PresentationSettings.exeC:\Users\Admin\AppData\Local\jjG0cj\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\wxDUg\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\wxDUg\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\7yZyv6pD\sppsvc.exeC:\Users\Admin\AppData\Local\7yZyv6pD\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c3bb9b9246d77c865f310eb61b747887
SHA105346db367f6923ef53c00b9a99157f6bf9fbda4
SHA256af4e4980c1b842409ad5f1ab07556d987247a6188bb78bd18e3aaff1af481d51
SHA5120a0811e5fa9dce99c2281b882c55736643d7fdbe95f1852c4664573efcde43a77bb94ebe1c4e8ce233f27b528fecc648f3fd9fd496cf30a9ce4bf77a664ad5c9
-
Filesize
4.4MB
MD5ec6cef0a81f167668e18fa32f1606fce
SHA16d56837a388ae5573a38a439cee16e6dde5b4de8
SHA25682c59a2f606ebf1a8a0de16be150600ac63ad8351c6bf3952c27a70257cb70f8
SHA512f40b37675329ca7875d958b4b0019082548a563ada217c7431c2ca5c7f93957b242f095f7f04bcdd6240b97ea99e89bfe3a003f97c43366d00a93768fef7b4c5
-
Filesize
219KB
MD5790799a168c41689849310f6c15f98fa
SHA1a5d213fc1c71a56de9441b2e35411d83770c01ec
SHA2566e59ab1a0b4ac177dc3397a54afcf68fcea3c1ee72c33bd08c89f04a6dac64b8
SHA5128153b79d4681f21ade7afe995841c386bff8e491ad347f8e7c287df5f9053cae7458e273339146d9a920ceaa2ba0f41cc793d7b2c0fa80efbb41477d39470866
-
Filesize
1.2MB
MD52dacb4e84c6d6dc7aeafa0350f958765
SHA17de996ae662593eda9d270ac75fc0b4de24ef64c
SHA256ca24bce93c9601dc3bb77aa57bc5cc82176a81be16c9ccbef3e2079f03f7b3d5
SHA5126d28418f62488bc8f93b5f5fea6d43f170cb2fff23f7d2b03d3bea4716d54d267cae396c90f156a852a39c4ce2a6e2db882ea2900c1834ae85ec4c4de684cc6e
-
Filesize
1.2MB
MD5df3d360fafbbad8e6bd6ed07a442854a
SHA1899faab7a891d9224f2005d3b25b0b68eec51c64
SHA256cfd0d35ea9c5727a40683c5d3acdb3a2d6a42fab8462348a733a60b67df20d92
SHA51211e64009cf04d319bbe045fad4bb33b3ea11fc55698c03f5d2cd0d84145e3a8168745ab9c2f59f3b2c493eced4eb3750e992fd29912002802b4d927d6311f347
-
Filesize
82KB
MD56711765f323289f5008a6a2a04b6f264
SHA1d8116fdf73608b4b254ad83c74f2232584d24144
SHA256bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8
-
Filesize
1KB
MD59ef5db5a485b9a9cb71e92b354808751
SHA1e453328113a17e168df029f9cecd2bee0094fa44
SHA2565cd810192bfdabeede4a4b8ec94e53972310896c03500df8ae952d222c949335
SHA512ccf602447564c63bfbb4799c6ec34280a1cf1240e7b730c5788b41c6622a72c377d3bdaa20a31d2ed28ff8dfa5504cb4b57fcf01154578ff821311f66b6da87b
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB