Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-09-2024 00:28
General
-
Target
e157bb91f2fe1d353eb5416732647237_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e157bb91f2fe1d353eb5416732647237
-
SHA1
89e00be7c80f2e9a47d4d40c578163dfb13da2ed
-
SHA256
07467eba6149f24096c0c3e26ac1cdeac1fe9757de8eef09f7083561c56e3557
-
SHA512
58f7e5943ce2110cf4cdaa3a5d28d3c60a4d28d0b0125ccd88f3ef0579c9fde66402921c4a5f5906426ba0614a4887b83fae04b1b4edc8b48f1a5273edf6398d
-
SSDEEP
24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NB:F9cKrUqZWLAcUZ
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e157bb91f2fe1d353eb5416732647237_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Users\Admin\AppData\Local\v37ZBJu0s\rdpinput.exeC:\Users\Admin\AppData\Local\v37ZBJu0s\rdpinput.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MoUsoCoreWorker.exeC:\Windows\system32\MoUsoCoreWorker.exe1⤵
-
C:\Users\Admin\AppData\Local\IMLXs6\MoUsoCoreWorker.exeC:\Users\Admin\AppData\Local\IMLXs6\MoUsoCoreWorker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\iFnR\BitLockerWizard.exeC:\Users\Admin\AppData\Local\iFnR\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD547c6b45ff22b73caf40bb29392386ce3
SHA17e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9
SHA256cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0
SHA512c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331
-
Filesize
1.2MB
MD5cc1ab8b54428a47bbaecd327eb7d60f5
SHA107cd0d2115242a6da007c4f6c3c385b8507100ae
SHA2568708806a9b31bf6dbd77b28c22cc983520d6e299820aaeaf949e0ae71284d791
SHA512cce1fcaf41a9f4df5630ea4cf4cc85ddf197d459333199505bbf5463926c709fc16460a6d52b8c97a280c59f6fae391b05791e09f3d5a2c5a7c94a52c4ea054c
-
Filesize
100KB
MD56d30c96f29f64b34bc98e4c81d9b0ee8
SHA14a3adc355f02b9c69bdbe391bfb01469dee15cf0
SHA2567758227642702e645af5e84d1c0e5690e07687c8209072a2c5f79379299edf74
SHA51225471b0ac7156d9ee9d12181020039bf551ba3efe252b656030c12d93b8db2648a18bdf762740f2a5cd8e43640e4bd4e8742310dea15823fc76b9e1c126876b8
-
Filesize
1.2MB
MD582b011d5aa4040fcca6cd2d3004c318f
SHA187a83eda8b32103a23c9b32593c2e39eccfbf80f
SHA25628a09bc7e4f5afa018e023888f2bfc1e9c5bf875074c95441d21f889ecba1223
SHA5127853e89851cbb4d788385aa0ded6e15665ffd2dafbd7730a32180c2a765d06389f80663269d7f51d1b2691d6d0292b8ca96d031194fee1f098259f6e096f51ca
-
Filesize
1.2MB
MD529f9ee24be9d1478efe67bfb2b0d7429
SHA174ac80e8a4bd0ecfdf5cf7d331797be04cf52289
SHA256bec0b281ceef394d4b22e167d45341b3db942414cdd279411786ed468b4d47b2
SHA51258df4631600a4bcf47596bbc99f7c74815c26bdbf24228ee6882391fa9dc49793b74aa10b5cb60c4c648a129780d4c60c09186222541318bb82830d1a24d396b
-
Filesize
180KB
MD5bd99eeca92869f9a3084d689f335c734
SHA1a2839f6038ea50a4456cd5c2a3ea003e7b77688c
SHA25639bfb2214efeed47f4f5e50e6dff05541e29caeb27966520bdadd52c3d5e7143
SHA512355433c3bbbaa3bcb849633d45713d8a7ac6f87a025732fbe83e259ec3a0cb4eabb18239df26609453f9fc6764c7276c5d0472f11cf12d15ef806aa7594d090e
-
Filesize
1KB
MD5369811f40f5dfecef9f16f1894e21a11
SHA1ce232b3d4915c416fdf6a4fee33355f49d497ecd
SHA256047add137c56839657ce235fc6b01ea43ae65d2e16589f46626fc54e188c146e
SHA5128686d86b1eaf42f3ad63aef0f5f34c691ab1bba9d8a783dd79757fd76834947fea6e78951832ebc473a1b6b5ad9dfa71a630da44fdf0a0ce11ddd29a8a295ef6
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB