Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-08-2024 01:28
General
-
Target
a908ca52629cfab8057cb8d662b488b1_JaffaCakes118.dll
-
Size
909KB
-
MD5
a908ca52629cfab8057cb8d662b488b1
-
SHA1
29d811439833907b69f1a6c2b09c95f499f52038
-
SHA256
139721b2a97521b2eea00f077fd1e95eb0859296937b1579b0223e8e16b5c628
-
SHA512
a2bb59d5211b2e08e4b277c78c9470580828726efcf39548a7b6b9ca51afa12c487abdfbd7762f45b2f7be2bdad357d9026c2a59f8558625c36f1508cf8db29b
-
SSDEEP
12288:Late3r/6VSBuehNcvwh8zqv8gxLBkVHUR8LlRYchYN7QBAs2bh:LN3r/fHhSv3zqvRLBCHUyj7BA
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 'dmod' strings 10 IoCs
Detects 'dmod' strings in Dridex loader.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a908ca52629cfab8057cb8d662b488b1_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\HErhszWN\eudcedit.exeC:\Users\Admin\AppData\Local\HErhszWN\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\9xro5K\msra.exeC:\Users\Admin\AppData\Local\9xro5K\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\TMq\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\TMq\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
910KB
MD5f923d4e02f2f4167274c466a67cda81d
SHA1142c9a46f1af6d07d9a768b06617001352d1d709
SHA25612acba0bdd3b3fce7d989dc47bf933584b918d63997013d85a10a0fd089423e3
SHA5124f40131aa84c8d591d41b16d92c14d7cb058801a03d1b09d3af68d8db5c8092fd76392262ef46d45b35aa075d8c4bb8f0016613b421bd322d99ccc793899f916
-
Filesize
579KB
MD5dcda3b7b8eb0bfbccb54b4d6a6844ad6
SHA1316a2925e451f739f45e31bc233a95f91bf775fa
SHA256011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae
SHA51218e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5
-
Filesize
937KB
MD50e390087ddbc66b7cbefa1fb442bbb7d
SHA112b03bffbff75248c66d98024b5f90edbc7aa194
SHA2565f9489f1e1bc5832c6d6bd366f6e2428042dbd9ec0ccdb01febb34c0422d38cc
SHA512eaef7f3bda24e3ceee87ae0110e32e877440ef5fd59424363ae2f4e4fa9c4ee085c0b257c8e730e5691a25ebea085c39fd8ea307513c9a2666c437d6a1be7898
-
Filesize
365KB
MD5a9de6557179d371938fbe52511b551ce
SHA1def460b4028788ded82dc55c36cb0df28599fd5f
SHA25683c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe
SHA5125790cac8dae16a785b48f790e6645b137f211c1587fb64ea88e743b846ff3a886324afcfef4bebc61f869023b9a22ba925c461dfb2e12497b70f501e6b79153c
-
Filesize
93KB
MD5d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA2562adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA5121191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f
-
Filesize
937KB
MD543b3bce31fc1937bbf0950ff0b36f8b8
SHA15fa022657ab0fffb375c665955691bb68a149c0b
SHA25629cf2c79719d413801e47edb7dd000c4ced2e030870092e58d0145bd53105877
SHA51249f1f40187569eb9e93e2457df9f4ee772d1efd3831acbf2fdc21a374551efa783991dd59b7ab19dc88551a3cf370e983433a271b50659c702c5e70cb1e57d8b
-
Filesize
1KB
MD586a952590657ef65082aea285dad2216
SHA1950a2e2900f54e10972ac72e8b5a24ccfb1c2abf
SHA25607016cbcf2dd14e8820ccca59de8a178e32684273e3f92a000091bed2594879a
SHA51204049783a88889857a3b2db840dc3149137ac15fa5f464b996a40b4549457b5973d952b29b0e0017200615e3cfb5aa1628fbf13c249fb573987c6b6ba5087e09
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
64KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
28KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
960KB