Analysis
-
max time kernel
149s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-08-2024 14:30
General
-
Target
967a503506ff447b27fe29ef9b72c2c1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
967a503506ff447b27fe29ef9b72c2c1
-
SHA1
b6378a7ad579db6ba868da3c051f6d38b7077094
-
SHA256
93524ff07e2650a8134290cd0c894af2b4855d4654788141ee640f34109f1ea2
-
SHA512
d7fbf7538148c5f22c51b82e9c98da414e322fb915f2fb3d103466abe7c35a4753b39eec181ceec22e381f091aaeed3c64007721e0e85119410c6c1b87093b1a
-
SSDEEP
24576:quYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:y9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\967a503506ff447b27fe29ef9b72c2c1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\bYVKwzL\FXSCOVER.exeC:\Users\Admin\AppData\Local\bYVKwzL\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\uqJ\cmstp.exeC:\Users\Admin\AppData\Local\uqJ\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\6GR7WlXeX\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\6GR7WlXeX\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD54a6e9c7577719570f905325b0624c157
SHA120d250816b8b856ab3e3317055fc825f7aa75b20
SHA256a0d03a615ded10705345c21323c8d8a1570e82248820cd9bd610dd9b0bdf9c55
SHA5126cb22283349d94782dd051c7609dd160bf135b18dedd2fefdf292eb2bee4b44206841809103d59a418fe512570c1e6fdadc295cb64214b44393ba37dca8e2f36
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
1.2MB
MD554de43d27ad089f85561e6e2632573dc
SHA113c98f87a612a423d0b9f7939368ca986296dcc2
SHA2565046f8d67f0f6378a6d7a08760ff5797e8d3bc3aff30c1df9b2c74b4b36bff8b
SHA5122f82dce9c59bdd86e82bd40ea6012b6d4ab6282a56a1dfc395f9d69603341c15f622082505de3dcae8ddb5132ee6bf6baeee7e52a2b198a87021004339946716
-
Filesize
1.2MB
MD5cfbad9972efe9a2cc6c3904362d3d60d
SHA1812798bf60e9c093080116fe73aad4d2c117a8ae
SHA2567633b9d4143fc557605ddde8ee333cf207d7783949ceb98eeccb18c1a6b53364
SHA512964db4845c0281c530c73a701a91c38a44d83ac1e34e140875423ea83f7f05e74d2f298626eaf28404b7bd5e225cb3894bd8c14a0d4cb985f421e0600a7375fc
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1KB
MD5fe43f0dc0e4ab669758b04d197eaed6e
SHA14fb2b178b8ec8dfe9a163df0c3598eda63e9ab42
SHA2561565a21ffa71ef4c5a36a66b91ada02544e2f0e03f11482d2388ac2b0867478c
SHA51255aae523e48fdd93a6d59747af8e63bbc53c37183bdbf6797f7ffd16f586bb6672149d71ba2739c9bb680ff67820127a98e00b7de35ecb8e87ca29cc92c4db94
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB