Analysis
-
max time kernel
129s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
31-08-2024 18:06
General
-
Target
cd52a36ef1f73ebca3e8bbb12b5f4a9c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
cd52a36ef1f73ebca3e8bbb12b5f4a9c
-
SHA1
5f7b23a06b43436f64d30ebeb64936d2816d170a
-
SHA256
f2f6b3965cee4f171cec6a3e05067252f127e466dd090fe5fd22d957267a2076
-
SHA512
0c259f41ba031cb19f74faab856f3afb89a7e82d6df0d5de673ef73e8e4d79a35342a314fe722c4dca81f01da60b4e608ef060cf16d2e118eae79ee79174b039
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cd52a36ef1f73ebca3e8bbb12b5f4a9c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\IJtoLE9\Netplwiz.exeC:\Users\Admin\AppData\Local\IJtoLE9\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LockScreenContentServer.exeC:\Windows\system32\LockScreenContentServer.exe1⤵
-
C:\Users\Admin\AppData\Local\slJ\LockScreenContentServer.exeC:\Users\Admin\AppData\Local\slJ\LockScreenContentServer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\XEE6Hk6WA\cmstp.exeC:\Users\Admin\AppData\Local\XEE6Hk6WA\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5204fa3130cdda474ecbddd38767d5813
SHA1f2904aa10ed3e221c3c543a9f82fb78d3a6e761f
SHA2565ee06ae4660d800d5927dc2e2fd4669b678d991c0a25d754249e9a985f6d5967
SHA5123bfe31ab1078254da3680037795dc0675953590922c586b63011a50915583172d73cb32f237cc4588f5e44dc322565d86999b2a69a700212943229f24fb83a5c
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
1.2MB
MD5317cc0162e9452e326d391947b9ca981
SHA18605d588f786fec586a0d8862d3010d6ed78ce72
SHA256186510c30a3480093190660e52304b749b2586b69fedcd5f4996deb357b308fb
SHA512bb352f3da0a362378d1f3b6856b85ae9673cd47bec35112ddca76fd575720bb2ff2bc1af3f7b2ad69ae13b8c9502c639f451b58b19966873b02ac5ec072cae00
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1.4MB
MD5b956cf526e15242863720a900a63f82f
SHA1d0f3d6497dc106d92added78e4ac694e9bd7a3f9
SHA25698f03f35bcb99dd4f70d12a0b261f2791941524c6640b2643ee637af5239ed0f
SHA51232df9560a8ee52d855c0ef3d07209de60e0ba4ad78e8973daf83ce46e1059251dd71ed8dc810d7b95fc560f74cc96e054acd55faf5a2e2510c5787b5734195f6
-
Filesize
47KB
MD5a0b7513c98cf46ca2cea3a567fec137c
SHA12307fc8e3fc620ea3c2fdc6248ad4658479ba995
SHA256cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6
SHA5123928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15
-
Filesize
1KB
MD5842f3d39e51b210def4837dbf139089f
SHA186f1559f2a63061ebfcd6f2fda011bcd6425dbd4
SHA2562d2dcb5b158a29f6ee998a83d37a38db1b95017cedda9a593f691cc50974bff1
SHA51231895d6c81756e6770d7aa7506062373cc150f7dd01898f271d45a138649898a7d38594248bccab8b60214877a719cfefa01c1155f1309394c698a04be69bde1
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB