Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28-08-2024 21:54
General
-
Target
c7b6baa928b733cbc9cc203c4f3a8f23_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
c7b6baa928b733cbc9cc203c4f3a8f23
-
SHA1
19b6883c6d058bd69f8e91cc9de095b885066eec
-
SHA256
7bc99dbbeb888112a6de767ad2977ad04ea059ea9e5fe8fce9c22e2d941659bc
-
SHA512
a6b594235fa702d123957e0120be2d0f95c04c09454c1127df600e41c2130649e9b47ccc03d5e71855b8325dd79e95df92fed00a39d9bd4500ded6aeebc29514
-
SSDEEP
24576:ruYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:19cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c7b6baa928b733cbc9cc203c4f3a8f23_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\BPvURSx\upfc.exeC:\Users\Admin\AppData\Local\BPvURSx\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\ZGyGAc5t\omadmclient.exeC:\Users\Admin\AppData\Local\ZGyGAc5t\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\mfH\usocoreworker.exeC:\Users\Admin\AppData\Local\mfH\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b3edb3990bfa61841e8904e6cb210eb8
SHA100df2a2e491417c8a5bb43250e6330c6d2cdeae1
SHA256c28d67144b7e4187c826463a03d6e63d21566384ab348f1f5f2830006ce495e8
SHA512d62775b1003a45fc13a3d904f2f069ab454f96e63864b92f31f413d5d1eb0f0b159cafdd975e72c1d5df3d5a8c72fa9164d78d416c035a09bdc6ede910bcd143
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
1.2MB
MD53206c53a1829865b940596bfe1fb281d
SHA11811d8d301eec76df0b9157a8aef66417457d220
SHA2568910f7d9e32575a2ac56c1cb2ea5659c6e4a4d15d39d5a256de32d38e3aa934e
SHA5127310042f70f03b79522fc1338c006c776ca9314705eaa6fbe2feda20117643328d61e59abcc7d1e44c3922f05848b0835dc29aa809e1774f9fbd08b2b4dff6cf
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
1.2MB
MD53dddca9b617d8ad166d8453df0940cc4
SHA11a2842d70676526d7a8e0fcc8c60ebf7085f0382
SHA256d059cbe087f317dc61b3421211a503b3881841f601992e764b6ee4151f818d14
SHA51286750ce3f1c0ef02eedfaf57d090b003fca5a0edc6128934ae9a971b77ca5c3d407daf29a9ce866afd493ed7e3eed71a75e55b0f38b3bd4327b4a9f2e708a720
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1KB
MD5415c464d89b673cfe69c7d9701bc40b1
SHA1ff9271f1e97fdafc3a41505fdde4d5521577f2d4
SHA2565a7ac086bf8953773e71d637b9d0a07342214db786e59166e6f66b1f53ccf3a5
SHA512fc4b37127a81ac557e127e6d78226a55ed3a75f769e2b49410778a3a1b114b6745e8541b5503799ef6bfa66faba12efae744538f661cede14f7ad20326b63465
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB