Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-08-2024 13:50
General
-
Target
a2c8e4117fbdd702afa7eaa9f3e4f45b_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a2c8e4117fbdd702afa7eaa9f3e4f45b
-
SHA1
8ef8013bd3fba4a9db7c2b003797eb59f3cc05c8
-
SHA256
40545a6526811c53e2e60af1d8df29607162db993879b289bddf2d2dab73e9d7
-
SHA512
20864d7b6ec128bd32994562d15f08b0b599242909c922c2e6eb4498dd6e2cd6292ffced315d9f54b4cd689387b2b6c5a1a14fe9a83fc0e6d28138e16e5db83c
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2c8e4117fbdd702afa7eaa9f3e4f45b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\ntRlJt\mstsc.exeC:\Users\Admin\AppData\Local\ntRlJt\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\omK\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\omK\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\L6LJCJDu\tabcal.exeC:\Users\Admin\AppData\Local\L6LJCJDu\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD53f601ab185b7e206f6f68f58a9703369
SHA1da1a09d49f810b32a5651d0ef7030baa5e73e0c3
SHA25696ffa453af23abbaab7bdcc034c2b76dacc49d07f3085f0fd4cc6860b82df207
SHA5120b1773b5d61f5d3dfcd9251b585977533e8cb3593a07ec28f9a8390bccc5c384adbc7b93d8cbf2147877052e72264dfcaa8d5ea4e1ef5673c0bec812fc0219cd
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
1.2MB
MD50f8625041b442d40075603cbe1f4da7e
SHA11d15c437dc169bdb0c75580e68c1a15a972aa07d
SHA2560af55feb758e3a7fa71abc756f26097d5ebe5882dff5eb2fc6ece95d8cb7842b
SHA512eeab7f0961ea12debd332cf6ad37052d8731f173cf8c090316d7944d38417dc6f0c172b2c88bf68d75ec7a7c155fd8b15f7cb0833c7fb9dd0cbeeefb82864c94
-
Filesize
1.5MB
MD53a26640414cee37ff5b36154b1a0b261
SHA1e0c28b5fdf53a202a7543b67bbc97214bad490ed
SHA2561d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f
SHA51276fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2
-
Filesize
1.2MB
MD54278a771e55be7b859a8e38d2887c3f7
SHA1b09d86d87ae6a5c301018352aa64abcd7642fe9b
SHA2564bfd5fdf216a1e28338318297dc0f3aebf79eb25a50bebd4585d3ffa9d01ea31
SHA512024ed6ab865886c1880e1da3fa9f228923a9e1e80c7637f80e845dd554c3bc890b7c8a804df4fde882a04b003b17d211b0bf62a0434051ec35a5af5ec70ebff5
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
1KB
MD5040b9537f1a50a4279b651e98bf07c0b
SHA11784832a46c4e9d0dda2c52760142c1085f94255
SHA256c3f26c5116c2993c7c9ef60066bcd055720e54b6ee2cc6cd054bcb5b9c029b27
SHA512a35976b724c8f01a80292095100a1820880305f96c4cd0491776aa1ba48671f94ac544b9260e38573cb5d46aee221003ecfb15918539d1d4e4ecae8200905a29
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB