Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-08-2024 20:32
General
-
Target
c3c93bcc9d7cf09e654aed755118dc42_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
c3c93bcc9d7cf09e654aed755118dc42
-
SHA1
c0fa398ff4e417f227437ac86c2c413ce2780553
-
SHA256
15fc496e1a8c2e1c17ef2dbf6fa1652413dc871ea598f12b6d1ea8cc4489665a
-
SHA512
78cd2acaa474107add69b9dda4b927bc5c1ff78fd1e72328b97a02575516ddc93254a093c9580b37b020572a7cceeeebdf8c9f6bf51e778b17c3a3414f92c8a2
-
SSDEEP
24576:YVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:YV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3c93bcc9d7cf09e654aed755118dc42_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\WLjUA\WFS.exeC:\Users\Admin\AppData\Local\WLjUA\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\RnCBQxff\PresentationHost.exeC:\Users\Admin\AppData\Local\RnCBQxff\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\LM7\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\LM7\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\Bz97y\omadmclient.exeC:\Users\Admin\AppData\Local\Bz97y\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD55dc5015e89929764e9ffb763285b0f2d
SHA1b711ca0c834394c4bb45026166d5a7c320528102
SHA2560ea3582c82b02af829ac5bf91d4ff9bb704d9e2d565f1a2aaaa4f18b86a5b69e
SHA512c7d9b548697bc9d4c16b84f892625a53a59f60de455347ecaace1763bb32fe5ae0128066f30594aa56bfe8c5d09a37ce5df2064a245d7181256e0bbb48777d92
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
13KB
MD5ee18876c1e5de583de7547075975120e
SHA1f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA51208bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c
-
Filesize
1.2MB
MD5c7a2dc2da89ca529340682e3d9891537
SHA157b84377e7f95a6532339bfc632e2a441737c32e
SHA256953c3850443a307e47ad21a36dd488fb36265b4a875bf296b9aae023f9afb8d2
SHA512554d28e25970fe94d92ae2c4fc31aad53c774b2efca9a83cb7aa836ec47c5bcd4b6b10d09a8b76a51e90ad0d4d46d95067b1161151e3da810c525bed2e0ac0c1
-
Filesize
276KB
MD5ef27d65b92d89e8175e6751a57ed9d93
SHA17279b58e711b459434f047e9098f9131391c3778
SHA25617d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48
SHA51240f46c3a131bb0388b8a3f7aee422936f6e2aa8d2cda547c43c4e7979c163d06c5aa20033a5156d3eeee5d455eeb929cbce89bcc8bb1766cbb65d7f03dd23e2e
-
Filesize
1.2MB
MD542655843c3644b8731c0e1f26f8033ee
SHA127d79cbcb319e1fe5860347b58d63efaec12e2f0
SHA256174fb1228b44064cfb3072ca23b575312f0c131882041dfe78d77abfa9b6dded
SHA5128121e0c35859467c73495b47d11dba713b0782d7ac1e4dbd619eec97590cdd61809b1c4f8e9f253108ee7136a17c09b53f16f678c9478ae85d0b0d9180502439
-
Filesize
1.3MB
MD5bbf01d8125257132097db818641b74a6
SHA1c17cacb529b586f52660dc2eed257686cf21c2ac
SHA25621306b595629f241a5c959e8641726b2db5ce16da1cd25d81f3811ce95e12f34
SHA512635e1664707681625e0b3e9c2f1a55ecd62c629b2080fcc06bcced0b04e715d8f583b63355a5a442f03227e2e169a20c941b06195f4789a4451990d9fffc3c3f
-
Filesize
944KB
MD53cbc8d0f65e3db6c76c119ed7c2ffd85
SHA1e74f794d86196e3bbb852522479946cceeed7e01
SHA256e23e4182efe7ed61aaf369696e1ce304c3818df33d1663872b6d3c75499d81f4
SHA51226ae5845a804b9eb752078f1ffa80a476648a8a9508b4f7ba56c94acd4198f3ba59c77add4feb7e0420070222af56521ca5f6334f466d5db272c816930513f0a
-
Filesize
1KB
MD58dfe342e3448043c4da5d7071b475761
SHA1ca642adb054bb0803ccaa48c2f02ec4642c7a462
SHA2562f23d8b4bf3abd510255de561f16fd2d9541bde504587dc83e509865698e626b
SHA512c62c9567cd937e04f29ad27205733935fa31389fce00a65151921468bc738e72e4142e04b49a4701e7e568d83bd3a1b4ec6634f4f126b3af6087e3f0f05b1288
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB