Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-08-2024 16:24
General
-
Target
b42d93e77b5c62799de6e15c87e5aa0a_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b42d93e77b5c62799de6e15c87e5aa0a
-
SHA1
00254ec7a4aea06c5836d06de5f395c03e8df426
-
SHA256
2fae4980756d9703b8adb56e7b874137e38a2a19d94874286517d7c753e0e3b3
-
SHA512
49dd41fbaf5f2107b041a8811a4ddd05d5e5ff6b52b4066c69b909cb2c7ccbb002057db58eeb2a0f34391cc7415963917b45b425510d3dfb2f0bd8350ecb21fe
-
SSDEEP
24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NF:s9cKrUqZWLAcUd
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b42d93e77b5c62799de6e15c87e5aa0a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\5tHcC\dccw.exeC:\Users\Admin\AppData\Local\5tHcC\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\HqGC5\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\HqGC5\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\wj3Sg1f\raserver.exeC:\Users\Admin\AppData\Local\wj3Sg1f\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
1.2MB
MD5dea0ae0ac3f670e03af4f54ef919e779
SHA169dc667f8c58cafdb5f65df0feae41ccb0a0c5ee
SHA2566288857cc358a93cb9a183b4f54621e4556e63b7cc052478bfb1cefe12807423
SHA512c04beab43fea826744beebac59091856550f07f1e73ce58b318dce79d306266de0ac6164d9659792ca14da9c942cd7eaa3c6e2ab9d6b3a529a49e1a592904812
-
Filesize
1.2MB
MD5b49b70db3f609ca701f1c4dc347299ee
SHA107cae3dd0868eee68f7fc6a1e440d79f402918d6
SHA256de5aa3348bdebfed4a48ff4c5391e2aad77b72912a5457e34ef6e9a77594d8ba
SHA512095cbfe7b8c4916d69c027d833fe3e57ea9e55e7aebc336a301a4b1d46be29ba4c342cd3c5468f3052539cacc941f13cc681199abd5a1a0bc7b12b6483181c63
-
Filesize
82KB
MD5e4fbf7cab8669c7c9cef92205d2f2ffc
SHA1adbfa782b7998720fa85678cc85863b961975e28
SHA256b266318d45a4245556a2e39b763f2f11eca780969105f6f103e53dd0a492bb30
SHA512c5c62578d04133352d6cb7b018df96a7b55c18d6111ab8bf2bfe232a3315a63b07047fa5b0b88551d152085776c66169b47566242c8c4c5e0333c55adc64e1b6
-
Filesize
1.2MB
MD5b16209efcd160eb0afe568ce9d19f34d
SHA12087c4c43742d05804fc5e5bf7067614b1282ae3
SHA2560b26848998a5ab24b6b11e9f38cf05d22bf2c4b78e0e85dc42a0f6db3dadece7
SHA512f4748fa5cfe1fa7b67d0153bc95690826c4e1646c41efb53ca3a2e4bc550549686109e88f67040f3a50919275c3e5690452e67a29f9ef4047c0361482685aa3e
-
Filesize
132KB
MD5d1841c6ee4ea45794ced131d4b68b60e
SHA14be6d2116060d7c723ac2d0b5504efe23198ea01
SHA25638732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d
SHA512d8bad215872c5956c6e8acac1cd3ad19b85f72b224b068fb71cfd1493705bc7d3390853ba923a1aa461140294f8793247df018484a378e4f026c2a12cb3fa5c9
-
Filesize
1KB
MD5da68291a2e2c375fb25c75ada758ca71
SHA1084f0a12e992a38d23990de0636414057424668e
SHA2562aae895626ce802173f75b8e55b0c176eee533ea7fb351163fe5e705b6b22e3d
SHA51270ee40181e07c6c88b17f35621027f9a8a874e26056a36c178a526d41425f40e05b1c720c11fdcb4a172945ecfe48e9ac065713f79ab2ad4040a6214000c0464
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB