Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 05:00
General
-
Target
ddb96ccf588109bc1b46976e539b206b_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ddb96ccf588109bc1b46976e539b206b
-
SHA1
2399f8c794e20b2f3dae8b299c2f067a9a873d33
-
SHA256
2b8d8798606bd8e1a6ed79a4ca0ce4fea163786b8b0232e0c4d52edb3edccc1d
-
SHA512
2f578acedb8be4dd594108e2d82c51098b3c467d76eee78dfdea36a22313bd7c02caf072513b4e7383a5724c999542936e40d9d0f2a7f685362d027adfde9db2
-
SSDEEP
24576:9uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:X9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ddb96ccf588109bc1b46976e539b206b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\h11Lf\bdechangepin.exeC:\Users\Admin\AppData\Local\h11Lf\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\FzoBtpdvX\wbengine.exeC:\Users\Admin\AppData\Local\FzoBtpdvX\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\7c4Fl\WFS.exeC:\Users\Admin\AppData\Local\7c4Fl\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD53cbc8d0f65e3db6c76c119ed7c2ffd85
SHA1e74f794d86196e3bbb852522479946cceeed7e01
SHA256e23e4182efe7ed61aaf369696e1ce304c3818df33d1663872b6d3c75499d81f4
SHA51226ae5845a804b9eb752078f1ffa80a476648a8a9508b4f7ba56c94acd4198f3ba59c77add4feb7e0420070222af56521ca5f6334f466d5db272c816930513f0a
-
Filesize
1.2MB
MD5da0c17b7f20e2f7f71157420f08de5bf
SHA19224fd941022a63057498b16ae84c51b7064317b
SHA256a4411c879e02517749865bcc185ae0f88a747991e66ef8c764f6605408017135
SHA5120e44c1a7dae9146d8251507d6f577531c4f6ff72fbe26028de6a3f4e4902700c685e2434fb24c79e6d261105e0f80c68c82a0fd3ca47a36cc8526d0c90fa09b0
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1.2MB
MD5ebf49abdbda9ba4f886fcbf5ea456a5a
SHA1f4cc18404147aad84e0afe218cd6442c1d983e2f
SHA256a767c85b13ee51db4b8ab4b957c93acb84e8703ba7e791869fbea46132a600a0
SHA512e51285388927b93bac32d41e197f82970bfc1de0c356020be5d4d87f5a78c0265055fbd5ca5065f7e8f49baf989aaf81eefb05387ce0bbb6c284d5e3c709bd3d
-
Filesize
1.4MB
MD5b1ef35382561f56c18c19222fe1e9e88
SHA145c31b384a20cb88ecead141ffae8d6f01ca6e53
SHA25616c5bbb5e56de16ece0fe31d3570952b731d005329d4a4bfb2e7b249f09e6dec
SHA512c836b9f67675407f4d862952f53dddaeac5bbb3997b4559363442d2a1998a0cdd4f1239dcf63495d0acdf06a1844af58fe2858dd16946fe2c74849350a81d69b
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1KB
MD5612763eb8864062223807827d510216f
SHA110d2894ad4e4900e870aafe1a44acfc4620938df
SHA256ab7c4d3d4884be82c59850f3c17d8bc949213cb99c07eb181f278456f4819cd9
SHA51275280be5ed048505ac292e6f046493ce0c9d473a82fc2ef66833d992f13028bd13289d34a285155d918cec4105fcfe9b2a8b301a722ae5228a11929ba312263b
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
968KB
-
Filesize
1.2MB