Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 17:29
General
-
Target
de915c885da0de165bf8c0e92d702b7a_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
de915c885da0de165bf8c0e92d702b7a
-
SHA1
27e5f69d7ecbeefa9babd6e43295dd62b9b9b8ff
-
SHA256
2579ef73b4428c682a9609a873d3b415a65ff2f61387d72270f1dcf5c07034b2
-
SHA512
9c7c80efbf5cc3142882ecc36ac9a4ee5390f89830d3d09c700ea153d8f681fd5976fc7e549682951cc0110c80e7cdc9bbbbbb5ddb5cd80b01cba385cb2f5477
-
SSDEEP
24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de915c885da0de165bf8c0e92d702b7a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\nTSx\dccw.exeC:\Users\Admin\AppData\Local\nTSx\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\zkGF1RR\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\zkGF1RR\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\eVs\wermgr.exeC:\Users\Admin\AppData\Local\eVs\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\quY1jQT\mstsc.exeC:\Users\Admin\AppData\Local\quY1jQT\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5f7991343cf02ed92cb59f394e8b89f1f
SHA1573ad9af63a6a0ab9b209ece518fd582b54cfef5
SHA2561c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc
SHA512fa3cf314100f5340c7d0f6a70632a308fcadb4b48785753310a053a510169979a89637b8b4fedf4d3690db6b8b55146e323cad70d704c4e2ede4edff5284237d
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
1.2MB
MD5cf735b4a3d04c32a3c549a031c87d373
SHA1d6a90c88de98a0b1a1d5e53b27b444fc59cf0a72
SHA256c2ed1693bef7afd5d4ecbbbe765716ba9d71c498d7a9ce9c8c9e81b91f72f81b
SHA51269dcfb0e61ea7fdb7edacb1fdfd0c171a7be94727d0d813a95a709bfd9e0f4da7158dd565eb3e9f779dcbc3980dd8d3e4fb7b50f4810944556e0efe4868195b8
-
Filesize
1.2MB
MD52e948f552ecc79c104939b6c8d82e7da
SHA181fa571c7dda00e65df64c42472749124f2eba30
SHA25604a815c2d5dfd455ead9ea3fb934205d108838bde8544ee3ab8d17a3446ab847
SHA512bea3830996ee0a4a63fade75979516a2eed2b64274ae934304ba53179a66ee5c1ca4fb5a4172d5cdfe3a35e5866d9bbc2970fe6bfa1e0e7e7563498f8162bce7
-
Filesize
1.5MB
MD53a26640414cee37ff5b36154b1a0b261
SHA1e0c28b5fdf53a202a7543b67bbc97214bad490ed
SHA2561d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f
SHA51276fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2
-
Filesize
1.4MB
MD5dc2d759319212ac0e0a885c0df472f3d
SHA1f2ccf7c5e4735144b68aaa575c96f3cb40209de0
SHA2566267b5092a41ea1d9b2fc269c23730196335bc750647634db89e9c21dc41944a
SHA5123bff3c44f1b3488089b8575f7bfc7f863a1b162daba2689d2f955e0ad3abd0198a70aa58430ba159874c2090cb619a2a52335de0de55e2d07b6423f3cafc0f90
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
1KB
MD5fa4d30f704e59e77cf3cfe870bfabe85
SHA10d7c3ba8dc4c1e8942703ba5dcf096b950811f0c
SHA256a0d7b196fe473ff143a7d44a895c61c6bf16267dc1e0898bd63079ab8c67d335
SHA512fce4e353db593cfa9b12fd0f30ba6c60b7a9c0e6537a72bc4dcaf80a99dcc74348f3c5b4cb7c17075677a7d619b7fa8afe321ebe45bd2142c43f7ea01bd541d1
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB