Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-08-2024 23:56
General
-
Target
982fabb733c2a30259122452b2464dd0_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
982fabb733c2a30259122452b2464dd0
-
SHA1
4b02a19b6354b3274f756d19a1496c1483a27ff1
-
SHA256
4dcf29b7d5c46b1647550492fea89934c0279562875c1c1f5d2a32eadddfef2f
-
SHA512
5f48b719565cb370e264d9443e0971f9e275b174caa06002d85f1cd596d3665113fb51b63bc99688d50072d8d4c0adb4eadb182e541dfd374562348e9091974e
-
SSDEEP
24576:fuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:h9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\982fabb733c2a30259122452b2464dd0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\2fJoHw\wusa.exeC:\Users\Admin\AppData\Local\2fJoHw\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\IHpkWv76\mstsc.exeC:\Users\Admin\AppData\Local\IHpkWv76\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\0phc\ie4uinit.exeC:\Users\Admin\AppData\Local\0phc\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD52b9924177be7ab6a0ca6ae3326535a7e
SHA12707e757d914da9528cdb0b3e7640429c1f53284
SHA256a8b3dfcf012e0a2f6433f6c350239a5b6748bc525f9c6ea84860d7d543565a91
SHA5129194c0a486b57a39f043e0921237b05e56d94c534b4ba6e1f2027456a38f825a090f20e7d64a8c8e83ddfe878f51faeebdae56acc8079d8cbe94d5dc2931f013
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1.2MB
MD5340669bd9ce1411faa23aa31a1835464
SHA1d2c78e432702ae159272715cf0a70a3f41768b85
SHA2568e5941c2400b59fd334107123eb11ecfbf3c1c9689baf1d2f382bdfd70563aca
SHA512c73681ee82b6c4f1a722fc838044008e22f383fe0240e4f88e784b57b4b493294717525cefffddabc561bedef251877ac407f9a39dfa5337772bdbea2a28dc75
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
1.2MB
MD59eb98700aa6e1d8d641b36813e6546c0
SHA1619c33cc4b27402555bb763d753a1b5909b8bc35
SHA256656aab45037ed2abf9ffd1e4d5d508847a60a35a725808edd6068efe2377719f
SHA512b0ae75d23c58bc13f8dfb4d396f522e8d66d0dd0af9e70c61dadfc4ddd69a0ac243f949c189e2a186211e27bd9ccee1e6810a93e1e698291d3f6592c2832c0fb
-
Filesize
1.5MB
MD53a26640414cee37ff5b36154b1a0b261
SHA1e0c28b5fdf53a202a7543b67bbc97214bad490ed
SHA2561d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f
SHA51276fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2
-
Filesize
1KB
MD50826872ea66a4f47efcf62f96fe33038
SHA11464f5175af7b57e223a9fce9c827aa9a6b702cc
SHA256763196086dd272afbe39a488345ceb08878de30aab224e64df86be1be5fc49ae
SHA5129b040be886e1d3638c4f23d58ac8507ea0c4d2dec408b497c9aef83eae94d978140782feca9773acc269141221c5d118e3f889ecc27d2cbd6b7de5260da9fd99
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB