Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/09/2024, 20:50
General
-
Target
d7124391cb48a2dd54731363a0abc0df_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
d7124391cb48a2dd54731363a0abc0df
-
SHA1
e41176662cbdecf7e10bb93ae809932610f2803e
-
SHA256
43edfba88ac4ef39ede058afdd0640c659e3cf939a920c7f45449bf514ecd9cf
-
SHA512
14e4f489a3bb06c4a00feac97adbc520dc3cc4c967d20482d6d18f59f7b6e2fc175dc1e31579b5ada833f1b4983357c02f4361dec2ca7fc2bcee050cc58dfe1e
-
SSDEEP
24576:fuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:h9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7124391cb48a2dd54731363a0abc0df_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\YAijH\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\YAijH\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\IwSoq7d\DWWIN.EXEC:\Users\Admin\AppData\Local\IwSoq7d\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\BipLCvh6\wusa.exeC:\Users\Admin\AppData\Local\BipLCvh6\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD52b63f14aaa23aa05c8e14d7a771c10cc
SHA1cfaf03ec300be4932049ec74692a57724f9ca47e
SHA25644c1295d226fc28e38a225c24f274aefcd57b556e3e1517e2ad75839b4c2a961
SHA5127d5d8bdbdfbc1e648aaa5c0b7dd5359d50d9e21f42a8df804c962e8d8e1bfb2d6e7e95fcfe94349c50959ac70f584b7175f1162f4d0d8d11175a7eeb58a74c3d
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD5ba17a0e45c0a4c3d4f55f81ccda4d3d6
SHA184fd18d60194d32f729b4bc7414b5f50c6348c89
SHA25619dd15d93fde53dbebd897945d536d57b5127282144b26d9cdfdbdc19fe25cbd
SHA5124acf988b53d0e70de70727254d0ef8d1f859c552cae6966d40e958edd19ed6b594c151669bc9adb616e0c2b79f39b7a4960efebfa695022ddca150c2f59bf85b
-
Filesize
13KB
MD5ee18876c1e5de583de7547075975120e
SHA1f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA51208bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c
-
Filesize
1.2MB
MD5586b9628218cdb2e593bd45336c86b37
SHA1c6b87dcb6f956bee2f88e8c4f17057ad8eb482c3
SHA25660b472ce5a9946581deac07aa48d24d884c5ced45fb652931c600e7a15b1dd2c
SHA512a40466d98747eaab7e74e20ca13c4275b7fd105f048ffc556719a65ed6076ae122b557fcefe2285683774109e17c32d21620ae77ebbc49ac89fe11f011b42713
-
Filesize
721B
MD56bbaba9d95a2b25be5648ac9bf1d082e
SHA18c5c4e98b5014440f9f2154f0409c52279baf6e5
SHA2568ccc5fb83895acfbd04b7898a04855b9c7e16561af44be844ca9a2c014ba78ea
SHA512e0a518a13699cfa59c2a6a1cd1ad4c3d6a5ec33ea1b129fe33cfbd6afc9d4082c4e3e80845018fa0cef2de21670762539dcd9d5af7992286ecf68b9b45b7d396
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB