Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-09-2024 15:07
General
-
Target
d69063a86c406e82e46e5747e5ef8794_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
d69063a86c406e82e46e5747e5ef8794
-
SHA1
55511b528dd91aa2b5fc7cd24916103a9ad24a5f
-
SHA256
7126dd06985d20a9411b370715973a5eda642003567fe11aed9848cd25cea415
-
SHA512
1b9a3def2cb145cc645828a7880b76781c25bf8ef8bf66f0c167fb9ccd924400a86b6cb2e51725b6d4297b75825291053d0e97edbc60d109b7d4f66681b881dd
-
SSDEEP
24576:vuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:R9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d69063a86c406e82e46e5747e5ef8794_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ie4ushowIE.exeC:\Windows\system32\ie4ushowIE.exe1⤵
-
C:\Users\Admin\AppData\Local\ZZSU0y\ie4ushowIE.exeC:\Users\Admin\AppData\Local\ZZSU0y\ie4ushowIE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\9C6QRp\dpapimig.exeC:\Users\Admin\AppData\Local\9C6QRp\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\32R5Ya8k\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\32R5Ya8k\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD535ad4d9696c7de891e5441aead6a7fbe
SHA1c7b92e935ec10227fd9bdfbff00304c45888009a
SHA2560e0917f40c8309dc1051f49ffbe86027daaa59637e503fd878e49f7292439ec6
SHA51278a40478913a5bd91d25736077909424091d0159fae0da4e471df2cc5cd56186448520352c6157dfae16d5b8b6dd1f8e909267c526b0a1c956ea62748dd2f9c6
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
1.4MB
MD51ca504a1f82d2e61daa4519a09a81c57
SHA176a7eac5719d1bfef07e572a7a4d36f0d4d67f75
SHA25638ba9e07df31234a3e72802caa4b5617cd9750a8336a6ee082f7807a070b3d2f
SHA512dd3a83f6908598922523c619c79763d7a89453a72dd7d4db57f772c1aecefb8b82583e4da44a3781d76c5fd36c4fc2b1cf6b096311386e09d03165371bd48687
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1.2MB
MD53df4576da2c601761c43298f6353a431
SHA162210fa6591fff99b4f6d943aed2b5454a487b12
SHA2569b296a44bf2762cd100882f382ad5479da7f0c836ec576fc0931777e2123e258
SHA51223bf998fec4567c56c83d7127591cd769246535b1f4c8f744e949fbf079d7a5006c7c9d3f0889150eed0172072861b388ca075e7bad3c6c7c951d1c5ccb0fb87
-
Filesize
76KB
MD59de952f476abab0cd62bfd81e20a3deb
SHA1109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA5123cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9
-
Filesize
1KB
MD52b69c904fcf19fde3ac86f5a8be6f2fe
SHA139df90576b78d5d393fafd345d6bd8661e707ca5
SHA256ad192dacbc4e4aea20647897df9514bd9d0171993bdff9c85a89a98496619b3d
SHA51260dafb55a954b77768de976bd15a21fdbacaf9511972c778ba3fb47acbc5483ec4d16c51dd7e4031188f10a9fa0d7e1d3bb61a880cc72a5c98d633ded7c8a4dc
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB