Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-08-2024 10:35
General
-
Target
a67261a15803bb7e21d3d22d97d8e923_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a67261a15803bb7e21d3d22d97d8e923
-
SHA1
f702e1a7cccc81d925e4b75796da0ace7aac8005
-
SHA256
b8c5142d09851bb8da18953b38041345f177a1ea49f2101da423f3d148a26631
-
SHA512
2f37783a9b247b9752b5bf25015fbbcd051fcc125bfc49ad8cc6d5df1da8457a0ea7aff6c3b14f2538d86e03c1534c032ec7378be20571ba5b1edfec4f0bc384
-
SSDEEP
24576:BuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:T9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67261a15803bb7e21d3d22d97d8e923_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\fcy5noIKs\raserver.exeC:\Users\Admin\AppData\Local\fcy5noIKs\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sessionmsg.exeC:\Windows\system32\sessionmsg.exe1⤵
-
C:\Users\Admin\AppData\Local\Xu8LB\sessionmsg.exeC:\Users\Admin\AppData\Local\Xu8LB\sessionmsg.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\j57eWlqA\BdeUISrv.exeC:\Users\Admin\AppData\Local\j57eWlqA\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58dcd8aebe89bce9b59ed5eb734393c10
SHA16453109a9e28e8ba08eaa31fec95df193c12245f
SHA25669bf87a45b8461881a96e08daf413e561278fbcc0324f6371e1c34b1089ed101
SHA512d42353854feef8ae45e0482e6a9153534ea15faa9a7b6177396ee9121e99cc843926b3240679b684952b8c35a13d0e01de32b1bb055b9f38e7fee85242e9d5f5
-
Filesize
85KB
MD5480f710806b68dfe478ca1ec7d7e79cc
SHA1b4fc97fed2dbff9c4874cb65ede7b50699db37cd
SHA2562416cd4aa577dbb2f8790a61e36fbab2b30bff81a4e1f67a5151c2fec29585bc
SHA51229d3d234ebc45049a533b6a91b246ac043a56b9af67276aaf493b014ae34d73000f99a6b0c0b85d2dfb7fba54811cf8bbdfd167a9eed01a8617b7f05bf2971db
-
Filesize
1.2MB
MD537336a04814c2ff2ef7f917f248b66e9
SHA1235c4792838bd56399de4897691d06f688ec9c58
SHA256a9a94dce7b1b19f300c73d0cffd3178b3d87379c1288fbf605a6bd38c7485e6a
SHA51283bb87ff382e7b059f86bd6a9738cb97bb9c1dce43a5de43dbd0a0249fa9edffe77b785dac1a96fe65b69e1ada3411aec9e8054f95baf0bfc2559965d8a08ada
-
Filesize
132KB
MD5d1841c6ee4ea45794ced131d4b68b60e
SHA14be6d2116060d7c723ac2d0b5504efe23198ea01
SHA25638732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d
SHA512d8bad215872c5956c6e8acac1cd3ad19b85f72b224b068fb71cfd1493705bc7d3390853ba923a1aa461140294f8793247df018484a378e4f026c2a12cb3fa5c9
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
1.2MB
MD530aa6ab55f1616731846d3cf9dff892c
SHA1057af93da0e51ae540ae5d4b590f732394e60dc4
SHA2566f0aa6a3c57b30a1cf70aadcea644885e457de3b553e6a63824ecd73524d4271
SHA5128c81a5cd9113c5c1d8332b55f853a56d3be45dd778c97801ea19db7156a30d6273db25b22beccda614fc730fcec8c2ab60fbe1b83cde5bc8ad595ea491742732
-
Filesize
750B
MD5eb89035f25eb9cfbdaae5469a9ec81c2
SHA10b9b33b18e1d17d80a79a8fd2dbd4ce64e629cf4
SHA256133f745b8d391b12df056b6483bf3c73ec9fa77e6a8dbf2ee8eb282119f0e5b8
SHA51257e1dfc95902f8dc6adbf41d607ab07ff0dfbe239aa57001318aca0060f4672e895c2e928ff475271fe8733f71e1fda6aa5f3ac56dd5c777f0bdfe8d10e129f3
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB