Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-09-2024 23:46
General
-
Target
dd4291c04dcea049af1211bed4fbff12_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
dd4291c04dcea049af1211bed4fbff12
-
SHA1
99c7c1882b1adbdca93d40b6d1bb670abe21cec0
-
SHA256
16e713fc83ba72915d16505d5350d1ecc99f13b3cf71b714da0471a8272ce5b5
-
SHA512
db7107eddb7b2291f936c3bbb3cf7a40239b6b4a041abad9707b5b0479bf6aa58d40be60647c01bd8ba05f8a7128f1d635cdaf8ebda70423e96a77f534a38339
-
SSDEEP
24576:ruYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N0:19cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd4291c04dcea049af1211bed4fbff12_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\EaseOfAccessDialog.exeC:\Windows\system32\EaseOfAccessDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\TCV\EaseOfAccessDialog.exeC:\Users\Admin\AppData\Local\TCV\EaseOfAccessDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MoUsoCoreWorker.exeC:\Windows\system32\MoUsoCoreWorker.exe1⤵
-
C:\Users\Admin\AppData\Local\Gb45eiWb\MoUsoCoreWorker.exeC:\Users\Admin\AppData\Local\Gb45eiWb\MoUsoCoreWorker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\5SOzJxWnT\tabcal.exeC:\Users\Admin\AppData\Local\5SOzJxWnT\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5527e1910b0c2e6113d50404ffa6872b2
SHA176842967bb1d704a2ef1c622c4db80f4880f1a68
SHA256e6634b64c91cd428967ce96766529130dcad14cdc8f228a8179595f654637889
SHA5128673b218b18fbe27d61c80a297ffd79923972ef8cec246a9a89d34117c1a43d97ad0ed432a826d0c616968a2c7cd6ede3f6ac8a468d26df13c7a2d4cfb83b6ca
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
1.6MB
MD547c6b45ff22b73caf40bb29392386ce3
SHA17e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9
SHA256cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0
SHA512c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331
-
Filesize
1.2MB
MD5199cb206a998e7a8581ffb078817d4a5
SHA1040042a6004fa1db3896e0c0ef8b402b33d94c26
SHA25610672581f33f3650ff408eb7b56dcc4204e18b5d49b0fad47e77ff2df1189afb
SHA51284776427be4aeebe9396f6b15b3ac5d9ac0b5ddcfa306a6cea647ff9c1c4751d86519991616defd19de1ceaa1051b194b1fc7a2e8f96724825670ae800184bb0
-
Filesize
123KB
MD5e75ee992c1041341f709a517c8723c87
SHA1471021260055eac0021f0abffa2d0ba77a2f380e
SHA2560b1731562413eaa972b373cd7388c644a3059940ce67eb89668e4073f3e068dc
SHA51248c3a8531df6bcc5077367cdf32af104c94cf7701118a85e8beabba2e9c4f511ae14e47b6d1b57d11a2bc1e8b4f6d5bacae27a8d16fcd09a8f9e0018f5a6370a
-
Filesize
1.2MB
MD5576bed2f0efe7c0d2857ba1487829643
SHA193797a74ab86135ea2a0db6569f3c1c9ae9f1327
SHA2560910bd44b9728ac4e59c8b2bad89a170af666dd64b727838632e247bd1d5eb9f
SHA5129d574eb05a779435ad076e70a846252c07cf786580ab6c88d008e83e4dd4977f8de79504a627d1c6d42248f719a15f1690fa3d99110441bc2364802bf190308b
-
Filesize
1KB
MD5262fffd570ec6bfb9d84053fa081efed
SHA17addb3fa2daf1804c056aa6fdd0307b7b33c7d8c
SHA2563b4bae96f2549969245574267272ac7a89cec55d0f933f5c022cff88ae9755d6
SHA5129db63fd1e4b79ebaf3b15f00dda740b21c41e0ce7b04d23115469cc9440d5d79fb91bd5e7b357f4cf4014700bd2e7b08339949613816904c0772bb75627862b8
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB