Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
31-08-2024 10:41
General
-
Target
cca80d9e068acff700587abcb34c5234_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
cca80d9e068acff700587abcb34c5234
-
SHA1
d9bbd6dfafc80c3a0af3a6814abd237cebdd6c55
-
SHA256
480819cebdae01d450d58cd97b2a92b70f2ba4b01e92fa3c99add416e1cb4031
-
SHA512
a9e55710194bb7958b642231466b6ff67be5afcb0081ff6563813be380fbb672a198e70ba5d9b2eee4cc71ba5c5fb7320169d99d03eef574917c43e68d92e2a2
-
SSDEEP
24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nlpt:s9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cca80d9e068acff700587abcb34c5234_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\ps5jtYYrJ\bdechangepin.exeC:\Users\Admin\AppData\Local\ps5jtYYrJ\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\hc7fmUWdQ\rdpshell.exeC:\Users\Admin\AppData\Local\hc7fmUWdQ\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\6DDNua4Ar\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\6DDNua4Ar\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5052d0072ca39a8f43737383f8450755d
SHA1b51e827766b7b1c22bfc01b533f81a86459e318c
SHA256de303767800375141993adcc17eb760cd9feabc03771317ec4cda42f79f38b30
SHA512879a6be8409e44d600f73f055cd730a7a546e369a6ae09e78d1657c2ead26dc38564a9f8233d7a34d936074378b2df928a64c21cad3b5f25b957f5c20af4db94
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1.2MB
MD59eea4a3d00014e7cddbd0b7b92fdc313
SHA17fc23debf5c4bed87787ff81b53aa42da0ab932f
SHA256da092f1950734a02ee51398f3371cf6bb796257db504bfd6bddd1c8aa9a4fbe5
SHA512b0f599d0364d5c1c1766a081c19ea03178a60e187a2b897ab1bed6e0a2500393f8f30ab14ef9e2b1b1aad81531f0ec6738fc46b985f144e68514755095352a6a
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1.4MB
MD5d7b1c530ee05c64f32987723bbf6aeda
SHA140c99c58c2d02654f95f116fef8ba6b68c110881
SHA2567db69dfb18a9ad62d927c9460eb5f2423e38c2b983b848c053610b5d549b63d7
SHA51209658c367b89a08cf1f6d840c6d639147451eeec3afb5d00eb5a60a9a076213300553716c3a656aeef7454950e25f885d7a4e3a02911afd98ccb5626843a197f
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1KB
MD53659df54db61976240c51d4d4e04df11
SHA1269f4ea44ed69589f2ce308ce30c17164908b22c
SHA2564ecf15db385618df073a304f9f3fd0c734b39572ed98ee1f6454d9b8686a7357
SHA512c042978a29a17f8249f784ab042fe1b93f358c8c4f537c7014e5b9430e58fc4dd3bd056c401d2b2124c0b1414ba76f95daea2dd32d062783b848a46eb7cdc2cd
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB