Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 08:05
General
-
Target
e66310ce193bb89ced004896ce2abec0_JaffaCakes118.dll
-
Size
986KB
-
MD5
e66310ce193bb89ced004896ce2abec0
-
SHA1
873677347b25d9bc2296a7c0308e4e6139139592
-
SHA256
3c7d900f40f2d8d8a04b5e2d20279fd248a490df62ebdf7f3bdcbfeb7921844f
-
SHA512
aaf6243e666eee429add8022acbf9bc6e10f54de0ddfeb9bcb661bf87ab1c92d65e61c8799e2dbed708a11a0a7a81e25585c11af04937a3b9da2ee76697841e8
-
SSDEEP
24576:CVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:CV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e66310ce193bb89ced004896ce2abec0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\PLfYjAE\wermgr.exeC:\Users\Admin\AppData\Local\PLfYjAE\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\bgA9qg6\usocoreworker.exeC:\Users\Admin\AppData\Local\bgA9qg6\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\rqq\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\rqq\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\6VDDu\bdechangepin.exeC:\Users\Admin\AppData\Local\6VDDu\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD561a82c498715f324f86f11a17794abad
SHA1edc8012e4d18f5bd8e47175e058321411b4db290
SHA256aa0d4c08e2595b93f7578d2cc84290ab0210a40d7af3614e66bd5dd97d1d04e4
SHA5127c98ba5ed13835e302a14f7a314cc3b3d0fedead46322bcf3561996b0aeb03335f666d1c40911aea5578fb1e524de3ce93f60b5b52191d24fdb5bff7f74319cf
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
223KB
MD5f7991343cf02ed92cb59f394e8b89f1f
SHA1573ad9af63a6a0ab9b209ece518fd582b54cfef5
SHA2561c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc
SHA512fa3cf314100f5340c7d0f6a70632a308fcadb4b48785753310a053a510169979a89637b8b4fedf4d3690db6b8b55146e323cad70d704c4e2ede4edff5284237d
-
Filesize
986KB
MD59a6c902506127052171365f4dae82672
SHA1c42e45fc281e7c7bc9eb5bb4ef2f29f30215a639
SHA256c1e388b9bf813859459c94845eead118f83db7f1109b260f60936ce880377eb9
SHA512cec22493dfc9fdabd35ae0c9d04ff1118dde171465bb9ceeec8ab25f0f18a08587bd3e0e8d04532d9f429ceba2ea15f4976c46852965703feaa575ed8ac9fd92
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
986KB
MD5f3079258fc0cbb15c4ac16506da4146b
SHA1d0b808e7a537308a1f38e5afbf50bfd18835725e
SHA256a62cfe2705eec220cd2552579286e5f9ae19022be607c949f426687620884502
SHA5128f2b0b3ab5b7e1555afad1f93f7937e81f16496b1685d202e42bc1433224cdc37aa8aa1f0fcf6d41abfb13671852bfb55f0de22570f8d3eec933f17ea217427d
-
Filesize
82KB
MD5fa040b18d2d2061ab38cf4e52e753854
SHA1b1b37124e9afd6c860189ce4d49cebbb2e4c57bc
SHA256c61fa0f8c5d8d61110adbcceaa453a6c1d31255b3244dc7e3b605a4a931c245c
SHA512511f5981bd2c446f1f3039f6674f972651512305630bd688b1ef159af36a23cb836b43d7010b132a86b5f4d6c46206057abd31600f1e7dc930cb32ed962298a4
-
Filesize
1KB
MD5de0268c84875dfc40555ed82daf3868c
SHA1069e2f8484913b962d813a7a680d4dc420d419bf
SHA2565ef4a6757fd15ee04bdc30b8a3c600b94234584bf1d0720dc53b12b5fcf76ae3
SHA512488957115ba86af59f648d54d24f25a1fedc0fa62d05f69315325b112d41fc732878607b220b004bf465573fcd11e76e587cbadc9b36377dbe7b7feadb69797e
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
28KB