Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-09-2024 16:48
General
-
Target
d2653bc52ac82fd57843f88b6cfb3cdb_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
d2653bc52ac82fd57843f88b6cfb3cdb
-
SHA1
27bdf0d4fa3e6088ab7a45849f826c125690ae08
-
SHA256
32b3250666fa89539a9e89b14b35032a0d496166592382d3cda4685c42a08aee
-
SHA512
24ce2014a7d984eacb7908f4eea16ec2a9edf35fe1e126005c71b5421efed6260bcd51f49aae50e151932c906bd1571e3e457d8a1cd340824d2a13013fea8364
-
SSDEEP
24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Np:s9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2653bc52ac82fd57843f88b6cfb3cdb_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\s8uMWaV\isoburn.exeC:\Users\Admin\AppData\Local\s8uMWaV\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\oISjpYr\mstsc.exeC:\Users\Admin\AppData\Local\oISjpYr\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Users\Admin\AppData\Local\EL2PueC\printfilterpipelinesvc.exeC:\Users\Admin\AppData\Local\EL2PueC\printfilterpipelinesvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD58ae2bb9d57aa57fa59da806d852acea5
SHA194c8db954d69c93d35d9bbccf5429b8875349ce9
SHA25655ff5f176a0b3c3f73f5654de620fef5f94ef44049afde99cfbf9c1b3bff6b2c
SHA512bd29ef024f0ae85e8d20681fd5e97ddd64c7615bb5f80b4b1e89dbf3fa376f8ba5478ecb22560737d96c341d1505acfe6efdea44e215567589a9bd131757f021
-
Filesize
813KB
MD5331a40eabaa5870e316b401bd81c4861
SHA1ddff65771ca30142172c0d91d5bfff4eb1b12b73
SHA256105099819555ed87ef3dab70a2eaf2cb61076f453266cec57ffccb8f4c00df88
SHA51229992dbf10f327d77865af5e6ebbe66b937a5b4ad04c68cafbf4e6adbd6c6532c8a82ac7e638d97c1f053353a7c8a6d7e379f389af15443c94a1e8f9b16be5f8
-
Filesize
1.4MB
MD5ae57dfd91f386cc459fa3795f464f5aa
SHA19eac4c0e4ae7ae37291d85d28fc9f8251830513f
SHA2563c81a153440acc549c9a8f017b83ae16c0e452fc82dcb16c0e1480a0e0dbaec4
SHA51285050b138f5b48f718b2a7fc06ff886112f713b413c7347ecdad7567062c55f2f5e04086e5e6924ea4575b2acbe4efafc96a6a82e52b5bbb4c2cbbbc6ea0f9cd
-
Filesize
1.5MB
MD53a26640414cee37ff5b36154b1a0b261
SHA1e0c28b5fdf53a202a7543b67bbc97214bad490ed
SHA2561d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f
SHA51276fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2
-
Filesize
1.4MB
MD5fc1be6d28a6e5d9fffdcd337c40cf698
SHA1a81c0d802b1bae36525f1d4924812713f7f21a6a
SHA25630d1590f6a222ef17022587f4e682912dff5ee53a70f545b3f31f638f01de9d3
SHA5121213ad724a07c1bfb674654ca0a2eb0c9d098f9c7941b8d0be13311abe0896ff9f19fe48f53dfa6c8ce870b8890a0008c5f8e0d7edcd33a529ebd6e25544c94f
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
1KB
MD555183b86e416043ccc11e7f557a73c17
SHA1f4c73a8964b0d638aff3a074b2853f52a6c1a2e7
SHA2563e538bcd5e957dc871f7ad5099153d3212f73723e779860376428e5c87fb53a3
SHA512d1b0605e5339364cc6bdcab0d5c2fd52baff058c5ef4521c1df9ed4a7f31efe489c4e4869872809dfb6a1839def9fd5ed5e35c278490021c8b2b2415888e6083
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB