Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-08-2024 07:07
General
-
Target
bac626c330c4f54cf739b1840fe180b4_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
bac626c330c4f54cf739b1840fe180b4
-
SHA1
ac00babc73192095dd0a99e15052dbc94b0076f1
-
SHA256
d590a58d203fa7da5c807e2bdd946aaf55f04d2413ad267dc07bbc97de70476b
-
SHA512
7452f661484866a623ab1c1b44c5cec0074f9f642ad6d15c0f3d7f1297dd3c224fa67f59d9e626627374ad4a57fdc1bb8be2a5e89a8f5a91cb3ef5d8732de942
-
SSDEEP
24576:uuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:O9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bac626c330c4f54cf739b1840fe180b4_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\C0ZdB\SysResetErr.exeC:\Users\Admin\AppData\Local\C0ZdB\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\368OSEjus\rstrui.exeC:\Users\Admin\AppData\Local\368OSEjus\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\bSAR\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\bSAR\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e490035a6d4b952abcc3ebde22cb3b5f
SHA1fc83eff212c320e11b168f6097ee56fd9cf68c33
SHA256a5ab869e25cfa21aae661aeb5700ec8646b28863a4f1e06e78c60e7c3e7306d0
SHA512f783f2465d93f179eddd48e70e308a4d769bd27ee3d5e59348f187e4e3d8e14739dbfa5d5afcc60ba80276963791ee548fa8abb27d85d082b9b83b832586873d
-
Filesize
268KB
MD54cad10846e93e85790865d5c0ab6ffd9
SHA18a223f4bab28afa4c7ed630f29325563c5dcda1a
SHA2569ddcfcaf2ebc810cc2e593446681bc4ccbad39756b1712cf045db8dee6310b4b
SHA512c0db44de0d35a70277f8621a318c5099378da675376e47545cfbfa7412e70a870fd05c92e0d6523ea2e0139d54d9eeaed14973762341fa3154406ae36f4ce7c6
-
Filesize
1.4MB
MD5ef8cbeda2b1df558dce4fa6f6ec0a7b9
SHA13a0bfcfe3081ffba84bcd625d2051dc016880780
SHA256a767c4dc55e1b37603baccd9be6e0bc5bce7c3c0ea6ad6d23523e3f5e8e2de32
SHA512989b8c7dd227abedde2f34e9e3353e5c553aaeb044983d407d0d04663f34551641a2f6d848d8c964db5207b67abe4089b4af319043b60c26eb4dea50e31cdc38
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
1.4MB
MD511a4bce680217f72aa00ddc23e0de673
SHA19a29ad57df54f05f1fb4988115625bae2c528ce2
SHA256d446b3c65db4aa76d3a05ef19e798b1865bdc1caea9beca8bf8e59c2bbb8b0a0
SHA5124d36c7139098807a49887ec2ff83d00e2e1aa1edf7794b2f79292db5624ad562e6bfb6a27a070e411c1218301029b8ff3e2982f2389a66681e541824a10b90cb
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1KB
MD55846370700aaa39e2135e4a514e68a45
SHA1663c20b95e2dea20ac288dc0b1ca955b2d6d396a
SHA25630bec11f51d68ecd805fb7c0bd0a0d692fc0ac94aff96dea632a0cb9c467d5aa
SHA5121578773ff99948cf199e6da83c55b8e96f4d77dd70df2b631e65bf4736527a0c59287d9a6718f28924e897ebb1687c43f537966565a40ee9bda97c4c8a4330ea
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
1.2MB
-
Filesize
2.0MB