Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-09-2024 00:05
General
-
Target
d55614e6cbad9762cfc2da2a9a63c4e1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
d55614e6cbad9762cfc2da2a9a63c4e1
-
SHA1
ccac6a50e607b7d04d08909f5b7cf599bb3fb251
-
SHA256
a6866e4ea5286aa400679b697215fcb3c11c72a67d0b5412da6a10e67086abd1
-
SHA512
87559e43ddaa3c2568702431f8b1856533697f414d9f6916e363d747d89c48d6348ea754ae18396cad7aff581c0bc75c35cc9b4b48dab85c9a00690178699a9c
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nrt:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d55614e6cbad9762cfc2da2a9a63c4e1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\o8UOVj\usocoreworker.exeC:\Users\Admin\AppData\Local\o8UOVj\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\9oYiWtmQV\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\9oYiWtmQV\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\naAp\MusNotificationUx.exeC:\Users\Admin\AppData\Local\naAp\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD57f881c7fe3f75b5deccb3c56815a68dc
SHA17f2b3acd32f47ba4d3d1b756b8be6da723c8e434
SHA25618803fd09c89567e051cfb74753bd69e14fe54eeded62290924f5eb3e89cc681
SHA512fe365736236cf42ff2fd4afa39eb93c5816fe5515fe3678d2d2c056967f5ef9e2488dcecb28b14366b12543e1670dca879ac914b7300b61bb86fe3299610903a
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.2MB
MD55e67a4d146ad9c07aacdfa62dab609dc
SHA1c6114729cae1c9206100f2297bef953e227e3dcd
SHA256a9a4c2e4bc7caebbd8dbe1580434c3b4e5a9a89f1211a7367cbcaf5a1a2d65e1
SHA512b465d580837f66cc351c2ffa60f79f15c03a7539533f24efd15b2184262b205d5ffaff0c5ef235035ac6aced9ae6f22a330f6bd201c421d5e7d72549ccbda0b7
-
Filesize
1.2MB
MD50f97efe04b82a45bf527af8efda06870
SHA1d328f565c8fa98f331fd59d18fd498b13b9cc47e
SHA256708567bc6ca4d0dc226c2822ba0e9138f179a0c4c50e32a15b2e4c83219f70e6
SHA5122c8ae28f3e6aca70384ddbcfc979337c5fe2239de452747dd81107e7c8418c8bc1381f6e91f5286cbec0c78eeed4a7e95f8707085513e0d3400d7eba21b8d57b
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1KB
MD563acce9db18dea962876fed617a45acd
SHA1325ac9f0fc1c13ffcf05a455a15cc82268f1dce3
SHA2565ee36bf58f8dcfd1b7a0d5fd6786a8ebeb2eb04ef8060211e1a9d609f5987a11
SHA512d6688acb7debe06e325fb9542390071d65d1f196b39c241207fa69b5c3ff62d9fe91d2e9b105e29ff6f1a6f34193af46c846587cae96e2dabc8c466b6cbfee8a
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB