Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-08-2024 00:15
General
-
Target
a07b656063b17069350a758375bf0e4a_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a07b656063b17069350a758375bf0e4a
-
SHA1
630f9abee5584c039c8853b254a8a3beb83022db
-
SHA256
6a73321338957ab1a99d1baa1a556b9d50708f20fe34c981e48e16597a3a5119
-
SHA512
22ebb45d8f5dab19b944a4d6b0bc3da307a13bb950b56f7c8a629fcde72277473fc988a849005c03a4dc150071d4647f762bebf0c1db3bce55dbc78ca3a76b12
-
SSDEEP
24576:3uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N7:59cKrUqZWLAcUj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a07b656063b17069350a758375bf0e4a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ProximityUxHost.exeC:\Windows\system32\ProximityUxHost.exe1⤵
-
C:\Users\Admin\AppData\Local\4PWjXK\ProximityUxHost.exeC:\Users\Admin\AppData\Local\4PWjXK\ProximityUxHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\rxV1u\GamePanel.exeC:\Users\Admin\AppData\Local\rxV1u\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\enVhGS\rdpshell.exeC:\Users\Admin\AppData\Local\enVhGS\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5fa003c6f3152146e1c68cd7938c1cbfa
SHA19f2828bf10d1ca4a2c18918079b1cde267967781
SHA256b29a301ee1ea1a3c1c5a9e926ef48229dc550384548dcd8373da32933e23c578
SHA512fe462fa1747ee4b37c3d9e4ce01412861853446d2d23fd3cc1d8210fc111aecb3a315e650f18b5cb3037a521fd54ea914afb2df9bdbef7a08bedcf9c68470054
-
Filesize
263KB
MD59ea326415b83d77295c70a35feb75577
SHA1f8fc6a4f7f97b242f35066f61d305e278155b8a8
SHA256192bfde77bf280e48f92d1eceacdc7ec4bf31cda46f7d577c7d7c3ec3ac89d8f
SHA5122b1943600f97abcd18778101e33eac00c2bd360a3eff62fef65f668a084d8fa38c3bbdedfc6c2b7e8410aa7c9c3df2734705dc502b4754259121adc9198c3692
-
Filesize
1.2MB
MD5b68acdbbb6a6501134df2a5304b17ffd
SHA10849cb0c1b997a9433f5f931585c1635ee837171
SHA256d00ad980d675bd736799f68de5709c2618b6fa8b2462366fcf11254fadc4a11f
SHA51214975880761f2793e331ac0a6bd4409409cbbe3d22c343bb59cac83ec718f2a7092d3a06a7b2db220942dfe26d5224d4e0b7dd1dc38f09b0af59a957a61a4443
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
1.2MB
MD5bd8f969dd921fa9d6a9435be35699124
SHA1967a3d4918b09800dc806a5a629b0f714d25ab7d
SHA2567f7a70c7af59950d5d6cf32c8fcee80c069548eb3f89781860312da37f519d0e
SHA51241d0a1daa86768640d00902ea3215c3f25ba30a4eeb31e366ee398c215030d6e613b649805486c58ac6faa3769ff1c63f1c02f5b13df956fb3b9f4f9c60448ed
-
Filesize
1KB
MD5f176cbca9769e20925d29fd319092dfc
SHA109453b60a48eec0b64bdb42f0e907a42b148217d
SHA2563a32498aeeb9686fefecbccc29ddd608a1844089f369edb5b73631ac8491525a
SHA5128bec426be8b7cf30c5d2cee48330d5171acbfe6cf6455a290f1fb08a16c2902d5b2b201d5f183894d14894c1743c1984358611e3bece78efa661e9d503c4d2a3
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB