Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-08-2024 06:49
General
-
Target
aa023b42d8bfbb61dccb9678e890f5f9_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
aa023b42d8bfbb61dccb9678e890f5f9
-
SHA1
4d4fa60f05778f0781f2bbb112bdeefd21846fe1
-
SHA256
eb9493d24f510de451b6e489d2136c1eb086ec4fac12f87848a7b6ba57f7dffc
-
SHA512
c375a14a25a7662b130bda2c4b9e24979c93bea59f29b4518f77780bf59accda028247591b60b8ad1ec6216cb45e6772df224ddc4d75e0c6ad040aa8f4770970
-
SSDEEP
24576:juYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:N9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aa023b42d8bfbb61dccb9678e890f5f9_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Users\Admin\AppData\Local\DTF\printfilterpipelinesvc.exeC:\Users\Admin\AppData\Local\DTF\printfilterpipelinesvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\q94lA0AjU\msconfig.exeC:\Users\Admin\AppData\Local\q94lA0AjU\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\WxsA18\lpksetup.exeC:\Users\Admin\AppData\Local\WxsA18\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e9b1f199b317170e0605b96c51f378c5
SHA1aa2dd0b9c267534e496abcaae8b5529972d950b8
SHA256da6cd28680b8cc742cf54a78f47a0449ce7d97aadc637c61f631c3b689c4f35c
SHA5126aa678faeb085a83796f33bf82b7efbb09a11fd35999618cd11ad5aa64a22f583087d046636d37ac9c057b46294c407defd138a35ba58415f079bac2f5219690
-
Filesize
813KB
MD5331a40eabaa5870e316b401bd81c4861
SHA1ddff65771ca30142172c0d91d5bfff4eb1b12b73
SHA256105099819555ed87ef3dab70a2eaf2cb61076f453266cec57ffccb8f4c00df88
SHA51229992dbf10f327d77865af5e6ebbe66b937a5b4ad04c68cafbf4e6adbd6c6532c8a82ac7e638d97c1f053353a7c8a6d7e379f389af15443c94a1e8f9b16be5f8
-
Filesize
1.2MB
MD5bb38c39a9c8c194ca80d3fc09e9ef5ed
SHA140b2f551e76c0b748048beeff27b827dd9d1465b
SHA25666a4dd27a1dcf49f4c63e1667ada8a1e7bb1861ca6b8457c59140dd9e28a0cbc
SHA51267649dad890405689bb8511b3e81f8c80d740e64fef1576f4e26637c52fb039e3ed0decd1a56de9c8ee4f5bd443c5a7d11a734e25996f1a555e29ce739996dbc
-
Filesize
728KB
MD5c75516a32e0aea02a184074d55d1a997
SHA1f9396946c078f8b0f28e3a6e21a97eeece31d13f
SHA256cb3cbeaaff7c07b044f70177e2899a87e80840d177238eb7dd25b8d9e20bef22
SHA51292994fdb75b15742e33e6d7a499664b722e45b9c160d8cc42d30bc727044063d589f45853692b5b754df6ff0fd21294dc32fed985b153f93f4bcf9f8c89a5bcc
-
Filesize
1.2MB
MD5f9799e359f7274c417ffde86c1ea106b
SHA1b2cd9fc844583b466d54dd98e746fa941e14f314
SHA256242b2ac570572c7891d0fde80cd696f1d8958c40f137d5969cac104ab49bac92
SHA512d1dd7303167ad9fb043d91075eecd4fcfcd230018b4c15306082c7234c3288cba0921e0520d9fb7dc9614759cdf73c1c8df7b1ab24733f11fcf7a0d8639788f6
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
1KB
MD51624bc1506dc74bbb67bc879c0b03773
SHA10ad8dbcc8e2e7658194a89357b8420b0c96f63bc
SHA256080e35afb9d5b8e9e11bf6b215481220504f30854f879b06807e2a5a207f4f8e
SHA512b9f591674816c315bcd1601c6eedb4495a9ed95ebd575cc2e935136ef2cd68d24c7335518f28fff364fdbf5a02cd207a5d393fbedb7d8963be49344e64aba556
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB