Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
31-08-2024 13:05
General
-
Target
ccdaece63d6ac64a80d629b4600b457f_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ccdaece63d6ac64a80d629b4600b457f
-
SHA1
71ce86f3f7908eeecd91a4dca36d68fb8e64f130
-
SHA256
9886df6ecc914c70bd45014fddf8bf12d3d3b66431f24fddd9cc9bc56eca7dbe
-
SHA512
f0755421fbe403d91b7fa7e6469ac2d10c697ac6763df6d230b25a5703936a9592024b712ab86a26a5c6576a38b2439af976619cc8a6e2ca3a3ed1b725c1f9b1
-
SSDEEP
24576:5uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:r9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ccdaece63d6ac64a80d629b4600b457f_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:81⤵
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\nZ7\sdclt.exeC:\Users\Admin\AppData\Local\nZ7\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\KzaW\dialer.exeC:\Users\Admin\AppData\Local\KzaW\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MoUsoCoreWorker.exeC:\Windows\system32\MoUsoCoreWorker.exe1⤵
-
C:\Users\Admin\AppData\Local\zSeZGF\MoUsoCoreWorker.exeC:\Users\Admin\AppData\Local\zSeZGF\MoUsoCoreWorker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58ce4f2498989b2aa979d1878e473e803
SHA17d98669b1473b1e4b9fffd2c55d3a21056a2b361
SHA2560a1d84d92c97bfaab9466bbaa8027549154d3048990418c8d604b3f50eda9974
SHA512bf957ac2fac4f5627d6386be6ed0b4ccfc286718de4d756fa53cc3f4be2c631a9da39a8782ca8c5a0e22a07e7d3841836f861f05b31c9cc55095cf9e20f3ede0
-
Filesize
39KB
MD5b2626bdcf079c6516fc016ac5646df93
SHA1838268205bd97d62a31094d53643c356ea7848a6
SHA256e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971
-
Filesize
1.2MB
MD5a137f7ff38dd5aff5c4ffdecfd8a4a2e
SHA11081a62b109616945f2f5f27d0ce6c8dc54692c9
SHA2568665e1f0df9577e00c3b7c3c924d57e1fbda62116997073567f6c77a06298cbd
SHA512bd048c48e31bca1cc142b7420db13dc011756827cb664aed08779d56d1de3883c10ebee6fece8dd94db888af7d99cf900ddc03a3056e24bc7eab47d9766599a7
-
Filesize
1.2MB
MD5e09d48f225e7abcab14ebd3b8a9668ec
SHA11c5b9322b51c09a407d182df481609f7cb8c425d
SHA256efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3
SHA512384d606b90c4803e5144b4de24edc537cb22dd59336a18a58d229500ed36aec92c8467cae6d3f326647bd044d8074931da553c7809727fb70227e99c257df0b4
-
Filesize
1.6MB
MD547c6b45ff22b73caf40bb29392386ce3
SHA17e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9
SHA256cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0
SHA512c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331
-
Filesize
1.2MB
MD56dd886a83e4b30c6d088a45ef809b5c8
SHA14fb98b7f0a3a7be271fe8a5b55819883d6152031
SHA256190a68fc9fad6ceea933860c4ab6e2da215f7e7af2c22d4cf05c91f2c58c1eb3
SHA5122177ad7f0b55babb2e042d28b417c68dfefd5e66b31b4bfe45b98052fcd1a5ded9324726bdb8c60b8af77b4234ca6e50296b4f22a99ef1319bcd446160f414b3
-
Filesize
1KB
MD5ce15d72658bb880b05da4e806316bc05
SHA1e13c4e456f62d4e7649cdad7d6c1a82ab98fbfa5
SHA256a25b3c6318016bfa82c129b2de2c76b4a1ed00c97faa87356b628cdf2432dc0f
SHA512ffb5faa8f166b7d7af87f3a2a2fd51d42c7ad80e8cbe076ffe11b3316b98abd4fa8a4423720a3176b0329c7019601fd93e12ae82ead151cfce987271ae59a020
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB