Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-08-2024 03:24
General
-
Target
a9645d8d4bd77b185fe75c17173fd55c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a9645d8d4bd77b185fe75c17173fd55c
-
SHA1
efe6d2a7684b2c66de1ef26484a2838d49629f02
-
SHA256
05f584345e0092fedeaf52c65be820f9ab66b3a53b8aa92d20d2ff5ad7ed499d
-
SHA512
d17e1e251720b509dfff40be060359d07589d811ff2a959c061c4fa929b7b5821c5e30488b63623dcf2cc626ffa638b31b5566a7e33bf9bea597a1b099ccd082
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9645d8d4bd77b185fe75c17173fd55c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\KI3BBZ1Q\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\KI3BBZ1Q\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\tzZH\wbengine.exeC:\Users\Admin\AppData\Local\tzZH\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\N6ls\dialer.exeC:\Users\Admin\AppData\Local\N6ls\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD55088bcb59f73940c8421480f3172d308
SHA199d9f758e9b101a0bd2dcca862137c96d5c151a8
SHA256c8b87151385d98c29805a9c12571cb3366dfda6ccacee778305e1d2f65706fea
SHA512e93f14739a5b181e0a04fc6f6302a2bed4a5de7fae16ce08c9588e969981f1c2af6cc85c0268ea332bb756c463bb895296122059ce7022f71abe8b7968d94d67
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
1.2MB
MD5c43144926271835a4fc807f225fd0ecb
SHA1a17069f176eaf36f9578062b2001273506e41545
SHA256cd360d8957b23ba29735ba001b95dbbb46f40200fe934f18412a9fd4c4e26f4a
SHA512772249a5b356c34c29bd5bb5c5b0175725530691b26580fd85de4892b1ebcc4605f1e05cf6aa79d33b4803210cdcb7c861ae7988cfe63c62eda85884ae2b9dc1
-
Filesize
39KB
MD5b2626bdcf079c6516fc016ac5646df93
SHA1838268205bd97d62a31094d53643c356ea7848a6
SHA256e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971
-
Filesize
1.2MB
MD5792a0b3a255040ad85ba12051e25de4f
SHA176aea54b4260a40f1614b5346f8828b489a9012a
SHA2565ade48a5860ec2c1be7c68828aa0ac880d696afabfd2751ac3df62ac4754a596
SHA5123d80796e98df1706a7c2f1ed64f7ba62276bda48ba0653e46aa969396cc6552bceea4c6f3efec04263698b4db38d66a0d9932ce1a6f82c7a942f5e454f2d176d
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1008B
MD5714fda20f25f443f8c53f6eb5f897f1d
SHA1b31cc229e8a51531cb6f7d258fe74b7b05562f3e
SHA256145211e0a0aecb388ef1a15c7a44f07f4d9aae238735c79951675eead04e5a99
SHA512fc2fb40b24cbfd2d75a6fb91e25e928bbd39afc99c66a6240e40e573e54bf967835363534383829c9614d2522dcd67890bafe73233b4fbdb5e9e2a20ce702dab
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB