Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-09-2024 20:09
General
-
Target
d7046a77abea80c3feecd1943072d1b6_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
d7046a77abea80c3feecd1943072d1b6
-
SHA1
d9896c3622da161c675d7ef431325b7fcca71886
-
SHA256
c6925804ea54a33bcdcc830d09ffdd297160f57775da5c00d32e11339e07730c
-
SHA512
3493cc0763646606dbf3483df2b6c76ed45b9412bf45f6cce0b499eb047fb209c0f84414e2a60ef5c8e2528c39241147467ec2948be4405aa8acd52e01b2b187
-
SSDEEP
24576:suYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:E9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7046a77abea80c3feecd1943072d1b6_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\hmuU1\DWWIN.EXEC:\Users\Admin\AppData\Local\hmuU1\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\W4qS7kay\dwm.exeC:\Users\Admin\AppData\Local\W4qS7kay\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\0EZ\DWWIN.EXEC:\Users\Admin\AppData\Local\0EZ\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e40c5e60cdccb2ad5edb89457de86647
SHA1fa1c93836e458fbe45d70bf4f9de5fb909e19a47
SHA256f36ac44dc3ff4f3ad22b61a9b764be2fd04f35b4fdbd37717803f11bdc90fb80
SHA5129e89c8a67db766ca7086c34729f5e3b2e7b123b30def535d9ebb73b2bed3fb8a04330965e3755fa55403bbe1093b19ef078a26469ab49a73fe16c2dad45a0625
-
Filesize
92KB
MD55c27608411832c5b39ba04e33d53536c
SHA1f92f8b7439ce1de4c297046ed1d3ff9f20bc97af
SHA2560ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565
SHA5121fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309
-
Filesize
1.2MB
MD5f523c2dc9c1281bf80ac389e584a507b
SHA1ed9960ab79f3df85e00dd2446160ba7109036620
SHA25641a82036289d26f02536040043f65e94ef2410720166fb7f21fd4a1d0033896e
SHA512da767ffbec84efbf4f24beacb2cf23ebbc0acac15191aa00fe34c7653dc0147500399543d6e5e56bca700ffb2d4a7b362da4ffb78f6e3720e792384050b5ca91
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD596b4aa6ad73978ac188b732b50639b92
SHA18ba2854c9340639fbce56e94326a36ee6dc48519
SHA2564801fdcc62e0331352df53623c25b205f5ece9c522b533e294592eb9e835e5e6
SHA512f835546e2b3a146725797d6c4021f739b81f346ae6760122b403f90d3ff63c2829c283a0e9ac628e3210d60ff8753a9f2aac019d27b6456ef626c8d983f0d681
-
Filesize
1KB
MD5bed0ec45ccada987962693c4c9fef496
SHA1c66ad7275e943d1795f19617b7e748f57efbd725
SHA256aa5a4cf2deb7cd80768d61bed9f2f29845ad691f24a643e42a8cdb23567eb799
SHA512d57b84a6ecab6c5a30dd147585079c2116e43b74a6b16496420000b7429e376533ab726cc0ba4cfb2f81bf00d4105abad1f8b06600ae7c4aa3ad8c6fca9fce5b
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB