Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 20:24
General
-
Target
b0b3677fee7f89faf693ca213d5a015d_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b0b3677fee7f89faf693ca213d5a015d
-
SHA1
ef0d03cc3e7ca79436e44f139ccee4e5d065a1ed
-
SHA256
e830844dc22da54e71775c667850099c419ea975fd46ae52ac0773851674d20e
-
SHA512
351cc8237892250cf03be76334365d619aeb23c2876afcd16f47d7b5004c4ea3359dda729cd9fe0e7234734c70896cd1dd77a0cad54d7734254f718a1473638e
-
SSDEEP
24576:vuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:R9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0b3677fee7f89faf693ca213d5a015d_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\9GN6Pa\raserver.exeC:\Users\Admin\AppData\Local\9GN6Pa\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\vCIGG\SysResetErr.exeC:\Users\Admin\AppData\Local\vCIGG\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\ekBZzC\SysResetErr.exeC:\Users\Admin\AppData\Local\ekBZzC\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e04504b17012d50faefbd8702c4e0b2f
SHA1873f4323824d4d82c057dc84662751ba372a260e
SHA2564a7b0d5e41b9b5565d3fa615ae0810c2a0ba23587a332ddeb96ebbf1c721eb06
SHA512e0a00a7ee75bfad39fba493e8476f90c8fa38be9074038a9fee4bd92fc4e55f12c4c5bbc88446bf481424d91835f6f19b06f824c025a1f811d7ef2678895bd1f
-
Filesize
132KB
MD5d1841c6ee4ea45794ced131d4b68b60e
SHA14be6d2116060d7c723ac2d0b5504efe23198ea01
SHA25638732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d
SHA512d8bad215872c5956c6e8acac1cd3ad19b85f72b224b068fb71cfd1493705bc7d3390853ba923a1aa461140294f8793247df018484a378e4f026c2a12cb3fa5c9
-
Filesize
1.4MB
MD5552b10faae9156c5c3f9235b4c09a21b
SHA116624110fb4657c5499d9f44cdd20877ef98acc4
SHA25639bab8ec70ad5fde5db2250cae4864f81769343cb024f560b8c70d4788e9b7ab
SHA512f6804e967b21e500d039949ce3f4a345c3850a2c28b47793eb198b34ca5eaa0b62e47c350b1e929eb05cbb30078c6784d7ce07ace2efcc74d595abc1ab5503c1
-
Filesize
1.4MB
MD507840f4e317b2673b60ca7d7a1ec1b0a
SHA19397b6e93f7cc529f31b5109938a1d53c8f6d503
SHA2567d8f11d10b0112249008699aa2f3d996caa55ef2f832cdec0b3d9860ba6702ce
SHA512b5c231d6ebf0d7b2fb002b36e7a3228e8a2296a936cd092e76a757e16c3940c0fd7990e2b3a15d20d9156e319d5687eccb839757a432e425fdb3c550762cc510
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
1KB
MD5adb9320486d9e1b2b84d0744b2eb7b15
SHA1035d986064212be34c526c05929322e6b1ca2d7e
SHA256ed5ca3c2ada580929366a140020e80a80c6f3efabc9ac3c12b1135e05091d8a1
SHA512928c6d70560800d3990cf734584567bc2f5c202f5ead99994bfdb6e272e5e91ef9397ee8720fb90fe9f3f240e9904c5d34f59d2b3a5435a0defb4bf19290e791
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB