Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-09-2024 15:33
General
-
Target
d24290c72ad04d54e46acbe21b617c43_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
d24290c72ad04d54e46acbe21b617c43
-
SHA1
b7a91df70b0620b578a3d709b5af18b2d8eb8f33
-
SHA256
c45a7ae23c315e0e5cb56d1bfe89d4a5ab30194c99f6f16b814d246f787c24de
-
SHA512
d07efe41fc582b3d838d6e6191af14737b9733455bb57baad38a77aa066cb8a9dbd36678810fbaf27cbf8bf9dffa59529dd9f078bd32e4131c4da5dffe835da6
-
SSDEEP
12288:VdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0TOt:7MIJxSDX3bqjhcfHk7MzH6zyt
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d24290c72ad04d54e46acbe21b617c43_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\nOA\upfc.exeC:\Users\Admin\AppData\Local\nOA\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\Y2a\LicensingUI.exeC:\Users\Admin\AppData\Local\Y2a\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\wC4RrmYe5\GamePanel.exeC:\Users\Admin\AppData\Local\wC4RrmYe5\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5922cfc3a436594805b28388a5196bf3a
SHA1d54b3455661d9d32f1ac60ecb5fed8f1714bc371
SHA2568a5a2a3758f54f6e64b6fc936cbe8a4077467f49070f63b3f7bf1dc0fcb5f34a
SHA512bbfeafaf3f34df68c2a6d8c1ca534f6fb0605a9571907cd2e76e0240058c33ee75becc82cc9fc29df611b89c91abf299496f506ec50b2e2281222a334693b92f
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
1.1MB
MD56c2082e91e76681bf9fab107f44b515c
SHA1b37bf364e5465b32fc49a79b59b9533b10c8a770
SHA256027a8232582a8b0e43f31fa0d74a6beec6553ccf12c7e31c06275cc00ee3a756
SHA512205134a4d3b2f54156c85b3d0b3aead83e8d363177b0bb78feaad9aff7ce2b0cf394563eb2493841b342501b1bfaba6a1aa1eca4de9985b3946d905a29463877
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
1.1MB
MD5d0734271c33200a8accd73dc8429ac55
SHA169750343a99a6e774d56d8f957085b4cd34c2c18
SHA2560ff2c5b3de887e869096a8711e173ccdaf11574fa519961b41720de5bb8f8eec
SHA512f45041b18ec0bdb2750d0f8d7f3cb4db538559b6631b6a18a011d720d0a730f2c6af271e7d38f2e65dc5c2a15cc8d0f9d560682bcb19002726e5552e895e74e8
-
Filesize
1KB
MD56ca5c2bc832a073a95ca94e48d18868c
SHA17ffafc03c055d16d47da43cb89475d8d8fda645d
SHA256290485d40da4f78aab8271379c5699adfae976f27a397d3446aa47bf590c838b
SHA512c32820306f0ca359b9d76f2a16bfcf4308a4e937c6cd687e5c1a91dc1ac0c8a515d937ca788a083b79f44ff598b431f1d6de4210f4195af32be7052a11450327
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB