Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-09-2024 15:39
General
-
Target
d88233c134145cb03ea57d46a0d34923_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
d88233c134145cb03ea57d46a0d34923
-
SHA1
ca7a8098357ce83214652ba7e02c7dc385861760
-
SHA256
44e7d8edde3c976623785b7bd9aef613f93911a38728631c59dc4c7d1b625e39
-
SHA512
1e3efe4ca779e216fa379aa69d87f9939c25c5f16b646f610da94bce18037cd13d78b5a05b8682cbd366fb9651fbf3e0baa95652f774e4e3c6a8d138947dd50d
-
SSDEEP
24576:5VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:5V8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d88233c134145cb03ea57d46a0d34923_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\oSdiLk\MusNotificationUx.exeC:\Users\Admin\AppData\Local\oSdiLk\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\z3g21TWE\FXSCOVER.exeC:\Users\Admin\AppData\Local\z3g21TWE\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\r1jF\wusa.exeC:\Users\Admin\AppData\Local\r1jF\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.2MB
MD5e0a0499140b7467a89528f34507a928c
SHA1b6405e8f541c0ad370148970f719170f8ae0e124
SHA25605636db198bb50d749750e5317ec1fb04b0898e3a12e887b4e6fa6c852c41225
SHA51217bf66ee325988cb4060f8832608ff398421954a224775598450e828454a98eec0626d38763e762f3fab71212a16c02535816cff17affde22b9938a40fdc8f7c
-
Filesize
1.2MB
MD5ef687c96927c475d4881258281b7c234
SHA18c35c45f537739d5cb0754f704442356e1ff12eb
SHA25628e651826c722f2ff5460dc526276d132525f67fb551a3aa4f449b9060285482
SHA512102d0ddb79ea8a7a1660d1219c5a87f6fe76aff7bd33d6af31ee20d0679e279d36c9ce496ee9e01ba375505860e85298892286e60d510ec0f684d6e43349edae
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
1.3MB
MD5abfdc98bd80b9c28f68cd228c9488fa0
SHA137235e2e242c099d1cd130b13122ef37d78938b6
SHA256837ee2e79837ab3854b56636e2e6b5942a6defedc3de929c5d2c3026cea44abe
SHA512a595f3001486306f07bc7a187ce1a406fe7268e6b8f9927bb2e5d68748b950166053f9ab7d58005c4b15c6ebfac5640301b29a3d9a1dc544f68e53571a096e41
-
Filesize
1KB
MD5efc07e3033ca8ec9959938cd38cfa031
SHA180b342900097bec1ac99bab2ce9a03d1dee022d3
SHA2561b0fb5ef32bdc020f2883ff32d5c2f01e79d192422ef8d790dd499a8198b6b6f
SHA512b419f1c9061ac028590ae9890faa756ce830959eeb64108d73c3ed23cb31d5eda651e4af62e14cb1322d303c8faed5c8814c9beeeba7888188918cb8254e1bef
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB