Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2024 08:28

General

  • Target

    d3f216eeea37381852976689b9c537a8_JaffaCakes118.dll

  • Size

    1.2MB

  • MD5

    d3f216eeea37381852976689b9c537a8

  • SHA1

    ba8d8d6b2319e53f8b58cf84376e15b214516aa4

  • SHA256

    28fb620bc8c98c777202e2c78138149132c9f237f75832028a3c01fd3009398d

  • SHA512

    ae12c4bbccd60faed5544f406f80c7be37a2aef001dd33d26069bea60d95a78b7c5807d188bcbc92e6ddbcff04584006c5a54013073dafadb0b3b9286966cb0c

  • SSDEEP

    24576:/uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NN:B9cKrUqZWLAcUV

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3f216eeea37381852976689b9c537a8_JaffaCakes118.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4692
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4404,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
    1⤵
      PID:600
    • C:\Windows\system32\dpapimig.exe
      C:\Windows\system32\dpapimig.exe
      1⤵
        PID:2712
      • C:\Users\Admin\AppData\Local\nARmGTXfM\dpapimig.exe
        C:\Users\Admin\AppData\Local\nARmGTXfM\dpapimig.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:5072
      • C:\Windows\system32\phoneactivate.exe
        C:\Windows\system32\phoneactivate.exe
        1⤵
          PID:3000
        • C:\Users\Admin\AppData\Local\mLnqa\phoneactivate.exe
          C:\Users\Admin\AppData\Local\mLnqa\phoneactivate.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:1280
        • C:\Windows\system32\Utilman.exe
          C:\Windows\system32\Utilman.exe
          1⤵
            PID:3948
          • C:\Users\Admin\AppData\Local\xlV\Utilman.exe
            C:\Users\Admin\AppData\Local\xlV\Utilman.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            PID:2272

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\mLnqa\DUI70.dll

            Filesize

            1.4MB

            MD5

            dd16c57b644561f6ff180a7703e4ac95

            SHA1

            70fdecb601b5609eb72c416d4e7ce4a9f98263d8

            SHA256

            ceccccd96c665acae7e9d7b871c9cfbeb034d49bbc68b154b48989bb17fc67a6

            SHA512

            6e0638dae4b5483ae6d18d8d16549d0efc2343bc7fd92fbfff9a25e0f97714a3cea050e061b930e0c8b6b20cfb34355feecf4937ee131edb7b2f7aa8937e03bc

          • C:\Users\Admin\AppData\Local\mLnqa\phoneactivate.exe

            Filesize

            107KB

            MD5

            32c31f06e0b68f349f68afdd08e45f3d

            SHA1

            e4b642f887e2c1d76b6b4777ade91e3cb3b9e27c

            SHA256

            cea83eb34233fed5ebeef8745c7c581a8adbefbcfc0e30e2d30a81000c821017

            SHA512

            fe61764b471465b164c9c2202ed349605117d57ceb0eca75acf8bda44e8744c115767ee0caed0b7feb70ba37b477d00805b3fdf0d0fa879dd4c8e3c1dc1c0d26

          • C:\Users\Admin\AppData\Local\nARmGTXfM\DUI70.dll

            Filesize

            1.4MB

            MD5

            e8ad24d94e7188bf2568801e3edb3d9a

            SHA1

            edf8e90ae8cb5b469c7ded3049d0beef88a2d9cb

            SHA256

            f03a5ee52650ceaa591bec871e39bde919012c0ed7d35354dd2fba821cc2c184

            SHA512

            a36d59a842d79ef0918a3a3a925f63599fc3372da4a919b5ef901d99b63bc05c6d372bc226f75f6ff70f5e01e1f6e71f56ec507e5acbaa7f5ea1118042270a12

          • C:\Users\Admin\AppData\Local\nARmGTXfM\dpapimig.exe

            Filesize

            76KB

            MD5

            b6d6477a0c90a81624c6a8548026b4d0

            SHA1

            e6eac6941d27f76bbd306c2938c0a962dbf1ced1

            SHA256

            a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb

            SHA512

            72ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe

          • C:\Users\Admin\AppData\Local\xlV\DUI70.dll

            Filesize

            1.4MB

            MD5

            de0d2068406cf8ec5b6318dd57a39f69

            SHA1

            17a577d712fc9baa97dd674cb909c94e9c5a6329

            SHA256

            77d21aa8cf58d0b9363dc78b235b01cb4c651000fe0bfbb09b2be38f1b963cc2

            SHA512

            da3a84ea9b2f60ae41156d49aebd760638fe83dcf7b18370d36f4f233b091b4af8e9e3df1d5a64b0f0916b646a6d4d9e4ced67565e4ee02fbf44dda394145fe7

          • C:\Users\Admin\AppData\Local\xlV\Utilman.exe

            Filesize

            123KB

            MD5

            a117edc0e74ab4770acf7f7e86e573f7

            SHA1

            5ceffb1a5e05e52aafcbc2d44e1e8445440706f3

            SHA256

            b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37

            SHA512

            72883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97

          • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Jmybglakcar.lnk

            Filesize

            1KB

            MD5

            13e7a48a36159f0f28bdad80ed4439b6

            SHA1

            50857ed48451a5d7a0dff1843720148fdf11221e

            SHA256

            587f24b86c224bda6b37d6bd0672797f24f10e8566899168ba5acb61c0b65935

            SHA512

            179774285324c49b741cfe080c3f70f68d5c8c739592239ee154fe77aadc44dcb093aaaac01e26ba2f02684bfa8948bad807943e082703c88399b52e9fdbf45c

          • memory/1280-69-0x00007FFCBB3B0000-0x00007FFCBB527000-memory.dmp

            Filesize

            1.5MB

          • memory/1280-66-0x0000025A8DFB0000-0x0000025A8DFB7000-memory.dmp

            Filesize

            28KB

          • memory/2272-86-0x00007FFCBB3B0000-0x00007FFCBB527000-memory.dmp

            Filesize

            1.5MB

          • memory/2272-83-0x000001426F0E0000-0x000001426F0E7000-memory.dmp

            Filesize

            28KB

          • memory/3472-7-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-29-0x0000000006F60000-0x0000000006F67000-memory.dmp

            Filesize

            28KB

          • memory/3472-12-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-9-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-8-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-4-0x0000000007030000-0x0000000007031000-memory.dmp

            Filesize

            4KB

          • memory/3472-10-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-11-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-6-0x00007FFCD8F8A000-0x00007FFCD8F8B000-memory.dmp

            Filesize

            4KB

          • memory/3472-16-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-17-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-14-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-15-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-30-0x00007FFCD9210000-0x00007FFCD9220000-memory.dmp

            Filesize

            64KB

          • memory/3472-25-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-36-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/3472-13-0x0000000140000000-0x0000000140131000-memory.dmp

            Filesize

            1.2MB

          • memory/4692-39-0x00007FFCC9FC0000-0x00007FFCCA0F1000-memory.dmp

            Filesize

            1.2MB

          • memory/4692-0-0x00000284E8560000-0x00000284E8567000-memory.dmp

            Filesize

            28KB

          • memory/4692-1-0x00007FFCC9FC0000-0x00007FFCCA0F1000-memory.dmp

            Filesize

            1.2MB

          • memory/5072-52-0x00007FFCBB3B0000-0x00007FFCBB527000-memory.dmp

            Filesize

            1.5MB

          • memory/5072-46-0x00007FFCBB3B0000-0x00007FFCBB527000-memory.dmp

            Filesize

            1.5MB

          • memory/5072-49-0x000001F671B30000-0x000001F671B37000-memory.dmp

            Filesize

            28KB