Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-09-2024 21:07
General
-
Target
e35c61ebe91c031d45c2ae5fee1ce298_JaffaCakes118.dll
-
Size
985KB
-
MD5
e35c61ebe91c031d45c2ae5fee1ce298
-
SHA1
18f2b3c265c8cb3dfc839e276c8b991e2dc03eaf
-
SHA256
6da8b8e1b1f1db5c5497500cc342b5778541c2d6584a958ce64ae77c09895ecc
-
SHA512
9b29a54deec72ef1e8c713da7659299df77a842e4543b2cf2d09dcea30cc68e87fff71e629acbf76feaada6a6019ac79c9ea438c3dc3d00d44f731bc767e620d
-
SSDEEP
24576:hhLBOY3Zch8R9trbCPQFaD0JAc8V7M/GGS069NmgsSF:pTFJawGGj6fmg
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e35c61ebe91c031d45c2ae5fee1ce298_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\nJrEM0X\mmc.exeC:\Users\Admin\AppData\Local\nJrEM0X\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\s2oT6YMYO\ie4uinit.exeC:\Users\Admin\AppData\Local\s2oT6YMYO\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\2GMrUIP\msconfig.exeC:\Users\Admin\AppData\Local\2GMrUIP\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\ci0vuL\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\ci0vuL\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1013KB
MD5b94a5c4405dcea66e9962acad4b68e32
SHA141571558e045ed596672c43866a8c43d9bc19046
SHA25635bc4c21f0d8f62751581b4a5c5d08ab6d3a332b04007df4565e9a7b69a57ee8
SHA5123a93696281c5893cbba24f5a28674349b68d6dc09c3322b559b3bb95d71e615b7023b458de7e129f9d6f527b44cf1c9462a59555ebd7b775f0b611fc7bf5a503
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
988KB
MD5f96529f1ecdbeb9b72754b241986e3fb
SHA1c21010e0a6e733623de9324e8bc4261c2397ccaa
SHA25604b41d833642316283ef290179d1dd0570184948478c70ffe47435046fc85039
SHA512239ed4ef1b5fad6f1ae667bf89e47e8c0d5815218829378c1be1bf23aab8990550b71a625ac6269938f429c7d1ed18da5d8f8398a543d835f5675cf4ab5ecf71
-
Filesize
1013KB
MD5ca61ccb9f2583e114a94b57f652bf6d2
SHA11bfa86554a9d514024c69329baaef9278cdd09c1
SHA25673a8ce4ec0d2233eb2ac73efe852cb9c9d3034e624362b31c690db645041c98b
SHA512f17332231e628121a95c5457852ae956f28565829a6c045dffc5ea3faed0bc717da5c7a2f8cb0fd01d8f905f6364620a930040ed00810c53349fb39b7ddae2ff
-
Filesize
1.8MB
MD58c86b80518406f14a4952d67185032d6
SHA19269f1fbcf65fefbc88a2e239519c21efe0f6ba5
SHA256895eef1eda5700a425934ae3782d4741dfefb7deafa53891bde490150187b98a
SHA5121bbdaa3ae8b5716ad2bd517055533e286ddb8a6c23cbc7aa602143dbb1ae132b513088ab61527c49737c554269c51416cceb80206ac8128ac6b003f1864eb099
-
Filesize
986KB
MD5c76cc2c430d302f3b1b2aadf271203a6
SHA17c742d9eb0feaceb2395fa19ef1ad11cfd8a788b
SHA256bb6b8ba78a9e89e4f19953047a9d9bb19574f4a727cb233478702eb948b0bc6d
SHA512073f66b023e9655e7438c582a344c62fb68250dd6da945c94d5508bd07b0a0eeeb708208559ac240b2e08a8783c533e84a853745ff35bacc4248a65ab475d729
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1024B
MD5f816e0abb135bc47f8c08776cbc9e8c9
SHA1f14df70d2f8f63ed34f429a8537ae75b3cf1573d
SHA25607a28b730cb475499673a1dfb7ada88ffcbce4ea5b22f45717aad6aebe796655
SHA512796f422d11652460404bd46bab184d3a7ac0b5d0733c23bcc41615a843b9cc214af6affad2292c9046316c167a7a2adb38a5314b7232d118f57aad6339c9a639
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
64KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB