Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-08-2024 08:20
General
-
Target
c0531aa81daf874d07f3ac24ce59d4f1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
c0531aa81daf874d07f3ac24ce59d4f1
-
SHA1
8aa0b1e290bf9b4335a8448989910b1f9827157e
-
SHA256
7e4e5b66b159d527d7f95083f708b94777aad062e5e665f3a41eb07d7891a60e
-
SHA512
abc190f52bc1e5f0a0368ac6f830254054cc5e574614c803cde4534887ee5e1e2387878ac0d72dc17fd121293815bbd29c29b34a077a2726b11b69a78b17666e
-
SSDEEP
24576:PuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:x9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0531aa81daf874d07f3ac24ce59d4f1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\aCxyyAAv\msinfo32.exeC:\Users\Admin\AppData\Local\aCxyyAAv\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\RhamyV\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\RhamyV\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Users\Admin\AppData\Local\sAO6us\printfilterpipelinesvc.exeC:\Users\Admin\AppData\Local\sAO6us\printfilterpipelinesvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD52ca20755c89d762e5a57cbcf3818cff4
SHA1b80e022d0e7f5a48e55f01ba563bc5b086bc59fc
SHA2561a0baa66ffb3489bdafebf1776242fc8cf8baf2299f90760a2348cef25c108f2
SHA5122ba4b9641b51e48f216d158e7ece3a3f3e9b42de5058811bfd2137ab6101d26879d751c7d48cbc37d22faa4bef0e906c7675bae0fc2ac63603cef7cd1df8ab8a
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1.2MB
MD5b1795cdcfdfa26d2b7c30d095cd5b3aa
SHA15ae7ab6fb1cf17fd70c2bb72b5b68e4ce74d482e
SHA2569e34bb986331b269033758cbfd33f796cd3e8ceaf08cb21865ab827c0b5a5afa
SHA512895b46bee2a32f3c17e9360c5873a0490c73ec3046dd0a2a20251604e618af02db02c691bbc35013dbfe122bf3bbc23065a1dfb1153d79f0451991cb89be71d0
-
Filesize
376KB
MD50aed91da63713bf9f881b03a604a1c9d
SHA1b1b2d292cb1a4c13dc243b5eab13afb316a28b9a
SHA2565cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14
SHA51204bca9b321d702122b6e72c2ad15b7cd98924e5dfc3b8dd0e907ea28fd7826d3f72b98c67242b6698594df648d3c2b6b0952bb52a2363b687bbe44a66e830c03
-
Filesize
1.2MB
MD506bd93cdbf4a880b7c3f48213306d148
SHA11579a866816f2b324f665b645c90ff1d502bf2a1
SHA2568b2268dd64c87a51e4fced0c7842ca24135c044a4154c140e37ac024b64519a3
SHA512ce31b8a96fc792bb86cc88259ba6894fdc18a2beac6d80184dc7e3b5795dcb2918b1ab8ba164d5646588404a7dcad49d38359520b57007048d598825ee2f8771
-
Filesize
813KB
MD5331a40eabaa5870e316b401bd81c4861
SHA1ddff65771ca30142172c0d91d5bfff4eb1b12b73
SHA256105099819555ed87ef3dab70a2eaf2cb61076f453266cec57ffccb8f4c00df88
SHA51229992dbf10f327d77865af5e6ebbe66b937a5b4ad04c68cafbf4e6adbd6c6532c8a82ac7e638d97c1f053353a7c8a6d7e379f389af15443c94a1e8f9b16be5f8
-
Filesize
1KB
MD538519ca8a250ab0d5ede10f199efbd48
SHA1496b488ea6345c18ecb9a24b1eee1980c569d829
SHA2569c4265c27e556e697660574319b9320857672bd90cf56008b73d4665627df3bf
SHA51270941eb9b799baeaf0edb571015eb5924176b555db2585af40853c5aa9eee5a1d550851ef1cecdb2fe0a42f6ca2d65312b9223fae9b0dd8cdeacd9346244fe00
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB