Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 23:05
General
-
Target
b1354a3e5555a634bafbb1f7d544a307_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b1354a3e5555a634bafbb1f7d544a307
-
SHA1
8b31570d013db1d63bfdbac53acb3359193fa565
-
SHA256
3b9b60dc1df3c32236efbfa255e992f1dab96551ffa4dfc533a00b6cf810d0ae
-
SHA512
73ae2f978f9cd855f41591d369ff7f606ab84a197322f85de8bb3ad177fbfe58daf3e9037004304ee9f151a382cbc00e9a7c4dcffe344f9d2e1875301fa24e0c
-
SSDEEP
24576:XuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:Z9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b1354a3e5555a634bafbb1f7d544a307_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\3uxbz3\FXSCOVER.exeC:\Users\Admin\AppData\Local\3uxbz3\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\mE4mWOP\EhStorAuthn.exeC:\Users\Admin\AppData\Local\mE4mWOP\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ProximityUxHost.exeC:\Windows\system32\ProximityUxHost.exe1⤵
-
C:\Users\Admin\AppData\Local\6cnAJZ\ProximityUxHost.exeC:\Users\Admin\AppData\Local\6cnAJZ\ProximityUxHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
1.2MB
MD53539c5f28d761fa6ccf6118b6ea2eead
SHA1748ee75655b2f6ac8eb1bbda01da35579b9d4999
SHA2565350938939eef041dc39dadde06e1158bd6737699d9584f3a890d7e6a0715ae1
SHA512e9725fe7a9f8808950ddcb90448d4890901479e591350c580277c9e7eaca4c2c75125fe7aeedd7a31eb4985a00fc1a9837433ed9a8c30308fd1f55b10e940eb7
-
Filesize
1.4MB
MD5a7b770dfbaf4a9d5bd894974bc171a96
SHA146928a74d860db83baec9c4fdaa7463adbc46288
SHA256117b91b461a5c4f6778031bb0295a3625711d6503aba4e6db2825b3966f7a353
SHA5125ec4571e9b0c8a0b78230074b43ce123823101d618ba0a8a1688459b9293ee8f16a8cb0ab1103484a530ba9c380f15e485fa7299ee13a4fa127ff586d1774601
-
Filesize
263KB
MD59ea326415b83d77295c70a35feb75577
SHA1f8fc6a4f7f97b242f35066f61d305e278155b8a8
SHA256192bfde77bf280e48f92d1eceacdc7ec4bf31cda46f7d577c7d7c3ec3ac89d8f
SHA5122b1943600f97abcd18778101e33eac00c2bd360a3eff62fef65f668a084d8fa38c3bbdedfc6c2b7e8410aa7c9c3df2734705dc502b4754259121adc9198c3692
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
1.2MB
MD5c2d4f81b8600cf232b8ac6b3cb5c55cd
SHA1eb2692ec2f5021863519e115622af9cc7faa55ae
SHA256199d07b6588bc3ad67060f64f74af017ae5b31a31d3534bdeda9ec8056d5e8e0
SHA5125f0c0765647558fb60c0572656278a2d98ea600d37317b3545289c70c2ca92356c5de26145652ddd2fe2faac7e356523dd4f1fc30be9ce88e5af73d77c29ea4c
-
Filesize
1KB
MD54ceca362c0543b90ae88b84bf8c2c5c3
SHA1b26dbdced701cff43ffc8b52d6910279580a0b02
SHA2560f04e0ab668f16e5fdf43fccf764cb7932ace2688291ca3e3f15700a9d590c59
SHA5127bf4718903b7280b2cf3e545461e6102d42ca2452cf084869b36838a50f65440721651853150704772daaa7ef1c899e44c417550f8119a4e0b083c6e6ea8f7e5
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB