Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-09-2024 03:12
General
-
Target
e197f60b0db3189f6af916cf489f6cb3_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e197f60b0db3189f6af916cf489f6cb3
-
SHA1
f1679a5453809d4cf2de3ea04e5cdf3aab48a0ee
-
SHA256
2556434fa80ac79faa55812f479fd1e14d0b7297d379f6935073bd5c6e25f693
-
SHA512
cf709ff4cd7671fd69d7bea310269ff44f031c5cd98fae96bc1835716d3911ab03477e7945da13083dd905e9e385f43df2d0fad56db870f0fa75b3bf58e08fce
-
SSDEEP
24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e197f60b0db3189f6af916cf489f6cb3_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4376,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:81⤵
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\NhG\bdechangepin.exeC:\Users\Admin\AppData\Local\NhG\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\bwB9jUZm\sdclt.exeC:\Users\Admin\AppData\Local\bwB9jUZm\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\nCsPGTfgZ\sdclt.exeC:\Users\Admin\AppData\Local\nCsPGTfgZ\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5c3c6e1184c0ef209e8bb8785dc0fab62
SHA1d680a97443583ff3160016e3858e2ca019d574de
SHA256a88a07961f535165a2aab1eb1b107538126afa55542c155ec83afd547e017ad9
SHA512b59bacc168ed36beefe4c4c13c82fc0f80e6f606199ecad97ef38a5d9cc121db6cbf7fb677917a3d1bc5259bd1f7161e6b73d140cef01d43227f1ca27c317aeb
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1.2MB
MD53081a4c282e99fd41240ed6a6f221d10
SHA1610f2e642d35b97d9154d17da0ce90778b4f3a7f
SHA25677ece80e69a022947a5625e2fa960c7c439d37d736fd1f3d95f13dbbc7b17fdd
SHA5129070d70ef519bcec7e213fa760e1d023da9e739dc9fba3c13a25c4f3fb368dd83e7d91dfa22d2faf2d79e5914729bd622c650ffc9d0526f928dce9f57598a33f
-
Filesize
1.2MB
MD5e09d48f225e7abcab14ebd3b8a9668ec
SHA11c5b9322b51c09a407d182df481609f7cb8c425d
SHA256efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3
SHA512384d606b90c4803e5144b4de24edc537cb22dd59336a18a58d229500ed36aec92c8467cae6d3f326647bd044d8074931da553c7809727fb70227e99c257df0b4
-
Filesize
1.2MB
MD5cc6a69f662cc91920dd3c95d905414aa
SHA1c78655a807e7f9aea1350aa1df77faded20f2e20
SHA2562598a60a7721514ab8ed0a7310391b47222390a1eaa80a0bb640176783bcd833
SHA5125f779067aa8d74a4191631aaae4c2a395ca86227c1a9bf52a5b86356f1d182c3a4c85e7e041d6862b7e9c6d0ce29b12a3347e7a621d7b7cd9d2624e01f5a5223
-
Filesize
974B
MD53b03c19b701f5c741e41f8e946797cd1
SHA1c9ec3cf7dc560be9cfa211cf10c173076752de41
SHA25680d73108ec85652b8a4a23eb926a6a5e9ac4affe55debd6889740bd8e82eadc4
SHA51274bac881c0b3c167be0e6fb01af7f56d2f956d24d2eadccf0894851a438ee0519f19c31f3e2ca8ca318285487b64773fa441f5e4316ad7529a76016f5703893d
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB