Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-08-2024 00:53
General
-
Target
a4c489c2af8ca511afa7de96641d2f08_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a4c489c2af8ca511afa7de96641d2f08
-
SHA1
f8f54d4f16282bf6cfaa33216ba9d7fed9e2c9e5
-
SHA256
027e62076d92fb4a2ba14c63b2e628d47d5385d2a9f8af691bdb674cfaa29ca0
-
SHA512
eb031dac63ac09ecaf738e8e2968ea785ee9f3fa151442a9cd934ce4073a93538fbabea03575c46de42fd14e8b0870908f5c1d26ca97c125bc8ed5265de64b89
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4c489c2af8ca511afa7de96641d2f08_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:81⤵
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\488z4\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\488z4\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\8qio76b4f\isoburn.exeC:\Users\Admin\AppData\Local\8qio76b4f\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\y1MMuaSY\usocoreworker.exeC:\Users\Admin\AppData\Local\y1MMuaSY\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD519d313758d2a4eee70a35d9c411d0086
SHA1c4fec81ab4ab8f7b7bcc1f2ee6747ebaebe42ff7
SHA256663b0e65c0fce907efbcd2603d5d98eb7a5ab80312071e0683457377ff9ff5ab
SHA5128840183816896624585d65c0fa2258e564ef6af76334b1511661091979eb553d1517e80189b2288a39deaa676765f64539b18ef031632cf85e634ea0b5ee12a9
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
1.2MB
MD566111914ee31435dc22784d20ac907ef
SHA186edd6a352b6019e09508b8f5352c42795273053
SHA2563c1398ef159bbbf1a0857b7638fd3504ef6a25c1b1b8d40dc89b1bce898ebfa8
SHA512466a56702963604065c05d490672bcdb781c376cc0f55dda60847dda46ae8096ff1485ca234b4f000c97f41816f88115153243d39cbb93dabb19d108da5604c8
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
1.2MB
MD5fe514c9fb5b948d2bfe4ee3b76e3836e
SHA136948859da604754e6fcced20111344612756e72
SHA256f88eba9b3b11af5a482545865a53d54f65de1e9097e9896cd2adcdcce70cd207
SHA512ca1c93dfacf7648f89a5b49915d05c19160fc5d09102ce9cb614fde35edffa92dfc3f6325f61fcba6bf2d43edb4fcf0ee6683eee9528b94983e65ba7640658bb
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1KB
MD5ec9b7a9137e96943d2376fcb1a5f07c7
SHA109aa373bd0f8cf995dd9ef19aee8758614c9049e
SHA2561d59401b0f04e23f1de68fce5526ddfe4bc2041801816f3a12d9bd9f2979081f
SHA512e6ac8d3bc9dc9144103043647466471a529ec50d657a2316fed2686d005acb7aa6e0b488e93382bc48838870a8dda24676b28900390e712f53286dde73f58b9e
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB