Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 12:27
General
-
Target
cf87a56aaa2dc88e7682b33d3a6e10a1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
cf87a56aaa2dc88e7682b33d3a6e10a1
-
SHA1
51de1ac388a07d0c3a25e3ee0a807a62e5494b10
-
SHA256
5a38c0f8a4964449b78f6d1a7e9685cbf59f04951226ba93e772db38f3709fc6
-
SHA512
cc2729ba0baf0e0ddca898d028557136829b317d06c962e1c02f90af7227aa15fac0979c473cfa3b19d70b9aca9382656522a008ad243628e9124c89dc5331d9
-
SSDEEP
24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf87a56aaa2dc88e7682b33d3a6e10a1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4384,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:81⤵
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\znR\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\znR\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\K7I\rdpinit.exeC:\Users\Admin\AppData\Local\K7I\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ProximityUxHost.exeC:\Windows\system32\ProximityUxHost.exe1⤵
-
C:\Users\Admin\AppData\Local\2WUu8P\ProximityUxHost.exeC:\Users\Admin\AppData\Local\2WUu8P\ProximityUxHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD59ea326415b83d77295c70a35feb75577
SHA1f8fc6a4f7f97b242f35066f61d305e278155b8a8
SHA256192bfde77bf280e48f92d1eceacdc7ec4bf31cda46f7d577c7d7c3ec3ac89d8f
SHA5122b1943600f97abcd18778101e33eac00c2bd360a3eff62fef65f668a084d8fa38c3bbdedfc6c2b7e8410aa7c9c3df2734705dc502b4754259121adc9198c3692
-
Filesize
1.2MB
MD5d249ff30d26af2a70127ccb974d749d9
SHA19bd9cf199fbdac4b0c8387a8894211db9a54e37e
SHA256fc6d7fdb4a9dfc8cf86e3df60f96ed3133a5484e11e764fa261b383bfd8f3440
SHA51202edf19ae57deb15d66f1a1027173572859aa51741e0e73e8527252db977dd97839a7aea708e2ed08bd743df10c42851a55f6f8ad9e64c489a7653beb7e02447
-
Filesize
1.2MB
MD5a064d1470330e5256e345ba182b7597b
SHA156477bb5736d3b42863dab354eb3fe66a1ac5fdd
SHA256455706a1957c2f72c98ee793cc40f14df07eccc1756bce6c32be61f4cd58dfba
SHA5127f12990aa12670c6297e26bc9e2060a094f68627d0ce3017d5ce47a4288b88d07abcc3b0fc267a4b43ca684ce5574d0972a2e691e8a8b8ac8aef381bccebdc87
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
33KB
MD50d5b016ac7e7b6257c069e8bb40845de
SHA15282f30e90cbd1be8da95b73bc1b6a7d041e43c2
SHA2566a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067
SHA512cd44d8b70fc67c692e6966b4ad86a7de9c96df0bade1b3a80cb4767be159d64f3cc04dc5934f7d843b15101865089e43b8aecabddc370b22caf0c48b56b3430e
-
Filesize
1.2MB
MD589ddb784b245037dd857f9312f12e327
SHA1ca7cbaed41dda25ee4290242013e01d4a511adec
SHA256078ea0c85c3bb4c1b7ea0167b8546ba2953dab01face6906637e74855bd5cb43
SHA512a271d82f0d696e089cecd21f28a270f1628a58d6315eabaa20c235931a93e236a4f346ff0c88dd264f8af8d430d9dc66d4e6b59a2a9f206107fba4d21619c48c
-
Filesize
1KB
MD53cc360e57197f246077f460216fff50c
SHA1441ac7ef28044902d898dd7f8856152f635b95bb
SHA256af79788f6a1f044114d73a9ccc931f3e76a2de4d638fba19f8078b5ac471d090
SHA512968cffba4905ab9979f73a6c678603685bb9c9eb7ed4df9f6aeada955168df5319918f468a21331bb085e7d74f755d1e2429ddf4ce360bd314558fd46655d501
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB