Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-08-2024 23:20
General
-
Target
acfe91ad1baf9ce432450d6bb0558e2b_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
acfe91ad1baf9ce432450d6bb0558e2b
-
SHA1
e7a99b007e443ddd625892f5fbd5bfcd5227ddeb
-
SHA256
c848f850797249c8c2315d762a79e6ea7536ba9ccb699f7d419907bb2a528eff
-
SHA512
bc946115122b04649d208ee4971d8aa37fde2214888afc6a4a201c486a03775b1d13d9873a44435ef803a1c48a58aab928249192c0f9648aac6398fc7bc5f330
-
SSDEEP
24576:ChLBOY3Zch8R9trbCPQFaD0JAc8V7M/GGS069NmgsSF:KTFJawGGj6fmg
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acfe91ad1baf9ce432450d6bb0558e2b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\pAl2oM\SppExtComObj.ExeC:\Users\Admin\AppData\Local\pAl2oM\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\NyuVPX6\LicensingUI.exeC:\Users\Admin\AppData\Local\NyuVPX6\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Users\Admin\AppData\Local\61qwVuq\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\61qwVuq\ApplicationFrameHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
1.2MB
MD5ec3c4eff95c208a25fc3f348ded8535f
SHA155d2d819e36f0c937c45a3fbe0a44cb88c8c01ea
SHA2565c7b5cf525a6e4b531b51a09425e6d44bf6c83001cecca5e45a9cf1cd085370f
SHA512a682347bb7c7050d5fcfb6fa2ac47c9e4a135423df64e05afc54555bec787177bd58e6e83434a3f185b252d68d8a9323c6201ad20ae5a1377d2c9155d7d4e3b8
-
Filesize
1.5MB
MD50dc740008f53efbf99c7c27166d98720
SHA164fb751da6171f10ec70c11c53c28b297645c36b
SHA2566e4f6ecf0ca9f628fdffb003f270f1d2b25813cacda098bb8974a27761c1ac1f
SHA5122c4c1a252fec81532f9a373ed67eb1270a83ecc0aba00d01abbc78a2fe86c74a4c9079eed687de5605c90ae4cf8166edc1ed1bb788918dd6b9b1ca04287e07b6
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
1.2MB
MD5d67da2ff3a01fb811fb3198ca2c15ecf
SHA1d83aa20ace1773e0f9b2d21c398e1d46dc18a922
SHA256b278542185055e3dbe5ef8586d4d20eee7a55c8e07645af1faf109a9a400af2d
SHA51293004c1d1886ce1afbe9c10de84763938fa094e487eb7f374bc9480bfba603e09e53aaadeb22c0b1082368405a2006fe8838f533f97247b8b214dbedf96cb033
-
Filesize
559KB
MD5728a78909aa69ca0e976e94482350700
SHA16508dfcbf37df25cae8ae68cf1fcd4b78084abb7
SHA2562a6581576305771044f07ea0fef27f77859996dbf66c2017e938f90bfc1e010c
SHA51222bf985e71afa58a1365cc733c0aa03dabd4b44e7c6a136eb5f9b870db14470201b4ef88a19fa3864af6c44e79e1a01d6f8806062d9d4861ba7dac77d82074f1
-
Filesize
1KB
MD57d6736c11337aaada3b888cfebdb0f0d
SHA18d8ba0315eebb0bf201fc377b39e1b7ac90932e5
SHA256cad65d1ebbde8b19b88000f16a17d3bf86538a3d23cd924feaaaae8b0b871b7b
SHA51263c8584625430f55953379c111a96d88f5b2fd848ef4177bb33fc40b8682895d40b76d1389840cfbe7a37d6dcaff25b73471627e51912d2fd1ebd6bae746dd3d
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB