Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-08-2024 01:09
General
-
Target
c1fad4e897cfb353e662f497347789ac_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
c1fad4e897cfb353e662f497347789ac
-
SHA1
a99d03b2b5f0cb26545802db4e02bc084167538b
-
SHA256
8bf41e771cc975937d4117383a49b019d875fe2dcae707a9c85962982a31e608
-
SHA512
0249475d0007c2ebdc99cf646c0172654df481d3be3b6821d27110ed444af2eab1ec1451df24e30afae68e3f2a098d358af877790833ee6993d041d4aff9eb2c
-
SSDEEP
24576:xuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nd:j9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c1fad4e897cfb353e662f497347789ac_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\440FuDV\bdechangepin.exeC:\Users\Admin\AppData\Local\440FuDV\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\jH6dM\wbengine.exeC:\Users\Admin\AppData\Local\jH6dM\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\pTLzuRyDt\LicensingUI.exeC:\Users\Admin\AppData\Local\pTLzuRyDt\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD566705648ad1535a0e27ba44fdacaa80d
SHA197621a2fd0d6f7ad15cd41c668c6fb3f84c06765
SHA2562d2e0ea56dad92d0d4f791a4b322c4ec346e154aacf756a2b99a44f42017552c
SHA512d6dbf56903f4e6a6d25a521b9c6af01a92ba86b61b69b5e5788833a1bdd4fa24cd7f15b590bc3f8eb845c6bb6444f9a17cf46053dd7eb4ab79986ca7603f25a4
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1.2MB
MD5411e248c984e4538640c209804f79160
SHA16f256a0352642de7b24a227297538e32eb415c9b
SHA25615c25978f371a417372a9d20ba12a89f44be68f3c6a56dbfcb4d068f710c9240
SHA512b87b01e42849d7a040c12bc61661e603ffb7688ee0f441050b380fa4a6dd9fc61438d00109e39a4a59e7d3377e829d826a497dc9b5d520d21021e6188f81e55c
-
Filesize
1.5MB
MD50baffd49c682bfd3054b55631341cf96
SHA10a9a4909f7adc499e6e39d26ac7d0d90ad02facd
SHA2566d7862c2ccbad356a743ea06911b606fb0bc23e3d524b7064d0be0589ab7eb9e
SHA512eca0af4b77f9cfea307776936167793949ec56a42db6254c3e5a998cf99dd15b66dc13af1e2f2e14caaf6cf5d90dab5eaf7eb81a331746b652280476deb986d0
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
1KB
MD5ca84a7b4f4efb59994e7f6592e58e73f
SHA111837121134c366cb7fde089b456f004eed7921a
SHA256aa4036ea49c6bcedb24b0eefcf3db97a9e6ef554835a57263034fe8ecfb474d6
SHA512ada6b32228b1aab7306838571e75e4bcc70182ef5fb4f535896d32cbf74023d58fee8f69de29215d257fd8c6835e11d74f94baf5b47d793bc0819b55c31a36ca
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB