Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-08-2024 00:48
General
-
Target
b9b6b51144875ab0e2b29256a5de1483_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b9b6b51144875ab0e2b29256a5de1483
-
SHA1
fa894de7d15f6ea99a125c52fae5a468f51d27a4
-
SHA256
57aebefa5e25857379598239bf44620b3cc86347e87215c1f2e08581f5af4d89
-
SHA512
45696f27dbcf76f3656622b43e7c2dc1df5c69f9a4c28122d1a0cab4945a5842f8daac1855d0e143d631a096bec5fe630dc7211b225ede8657a5c61d4a471f63
-
SSDEEP
24576:KuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NhOO:S9cKrUqZWLAcU8O
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b9b6b51144875ab0e2b29256a5de1483_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\wB87TEeLY\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\wB87TEeLY\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\amF8WYdI\mfpmp.exeC:\Users\Admin\AppData\Local\amF8WYdI\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\ITbNV\dpapimig.exeC:\Users\Admin\AppData\Local\ITbNV\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5986ee3b344ba7c2fb044ac424616c991
SHA101ee7935a9ac627468ca085f8d616eca2608236d
SHA25651dddafe72e663b0ffcddef03a407299009bf8433ae54b395dffd039e6bbeb89
SHA512799aa0877b07c85012e9abd683e35aefcb9a0b86f6ed3c05543b9dbceeb3ae296de11bb885cbefaeee7ff97c46c86770e012a35c76ec7594819775392171cb4c
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1.2MB
MD534fefbd71f0bfa640fcdda2c90d869ee
SHA1d2ee379b1f2cb65d597661ba47ff27d9e4e16882
SHA2565eaf625927404fb8b7edb31286cc97dcac4191eb7cb0e763ee342d5c2978603b
SHA512569ce6867003a35b8ee72a5c149d28f5cdc106bd2a0bf9824cea72b4861cd5858675b396d7ac7944a5a15626923027bc3a6dd7a5142d539befc4833afe1206ad
-
Filesize
46KB
MD58f8fd1988973bac0c5244431473b96a5
SHA1ce81ea37260d7cafe27612606cf044921ad1304c
SHA25627287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e
SHA512a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
1.2MB
MD5d829dca48e0e58ab59d2cccf68e3d204
SHA1016ceb12203be6b648638f423fdb44caa334e234
SHA256db668da82936c5e67d804cedda6d167694a87941df8e56c24d33bbf1537d2ef4
SHA512a18ade583a374b3f0258d6e57691a9153af755aea4df41c49f7d96ca9dba4eeab4abcd741cbe58271c68f50ba394fea39a46a19f7086eefba623d4db2c89ced5
-
Filesize
1KB
MD50b1e7bc6c7f8fc49eb41c36978090688
SHA1eb10847e5186cee362363c5d331aa8b3dbac9d30
SHA256d0cf932865a27c595efff2c56226c469eae8dfb25dd7eb6c54cccb6b3b3547aa
SHA512a70c42013ce16df8515c9820d8de88d55f1c59c09da64aea3760217aa4a94508279e7e1ce86fd343b3ab1f273b25c79754c25489e8d27557896ef9da11c4ba3b
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB