Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 17:16
General
-
Target
b01fcdb7f976ea702d6ed85384860517_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b01fcdb7f976ea702d6ed85384860517
-
SHA1
a98626defa6c2fcdc1f8c94989630b178e4525b5
-
SHA256
acc1afe396b1cea595c410a56c82f0049395618df8725ff337259994b0d5b486
-
SHA512
4629219101f8d1b5905a8bc282db82afbb7110a1d5102e4f860f73fdd9588fdec3afb47c954194428a77ae05add3fc8a829c8064b1fcb2d286eb82fa525fedd9
-
SSDEEP
24576:KuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:S9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b01fcdb7f976ea702d6ed85384860517_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\GJCgOKB\Netplwiz.exeC:\Users\Admin\AppData\Local\GJCgOKB\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\ahiP\mblctr.exeC:\Users\Admin\AppData\Local\ahiP\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\RcpX\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\RcpX\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD562f0510391fd3142250f153f972f9929
SHA17e22129514907fcd4d04a76c441bbc8d74441b18
SHA256d20db7ec37b68b49f608fc4be0211f00745a7369832a42c3073719227ddddb6a
SHA512b9f93571cd5cc520b022bc61e562d7421e8df57ab2ad7ac36997a28d20587e7aa7220b5ff7a24998aa932250de737eca3649f605247fce980645440398779ecb
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
1.2MB
MD51cd7cae845597609fddd107b25b303b1
SHA19a9320f944a9ec2dacb832b763665d9b85d9fbf4
SHA2568dac39f0e07fa0e6072905f514d3469e39924482eb5f06ae6fc047160741c71c
SHA51264dc0fe93d7b7c3c5b8e4e646321eb1c796ff2d59fa8a19d8b338d4eb035f138eaf4e2178dbfdc2a8f9dc37df916d11e4df4267e0591021610ab0d43de7f3fef
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
1.2MB
MD5918328419f4f5a89b57c8ee8cbfd2f0c
SHA1923658d07272c789d09bbf99e7f2b097fbe71c7e
SHA25620587091903cec21790571d1ef9c7cac46d7e17d60ad2d450cd8acd9bf599928
SHA5121419b30423a619fb8ec8af5fdfc3c62fbda36633a94f72affeacbafe5468ba9f3ca5ae5dd6ef525df122496e33d19d897f2ad7f086e3c75fec07a1d5a4b95fe0
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
1KB
MD5d5e677145666deb046552842c528f95c
SHA1b7dc125ad930f1aa6d6211b17a0cf640c945eaf3
SHA256091ca19c610953f304545d42f205d1a8ba928e2aabe1c3d7d646f2eaeb38ab60
SHA5124f33cf85bb6190a72e575440d073e07504bd02d8508fa57ff6f867f7bd2cacac639e56960f3b9ac10a25f2b3626f66df594a3370eb364df27f982e985fad2c16
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB