Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
18-09-2024 01:29
General
-
Target
e8117100d5ebd3aa4580e80bf9d2dabf_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e8117100d5ebd3aa4580e80bf9d2dabf
-
SHA1
fce6f07ee2719f8aeed4605302aa59a4a83733d0
-
SHA256
66b88b6a6bbc1178cd69d4730d4e946ac78fd7b7941a7752c269e5526475a48f
-
SHA512
5d088bc52d77f63e74ca665c234c8e6180f8dde3087a3df95c5ec551e89eb32c11618b4fa6ae538bbd16b2d7942293544b769ec3de06748a359633f74aff4c66
-
SSDEEP
24576:tuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:n9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8117100d5ebd3aa4580e80bf9d2dabf_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\LkE6E\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\LkE6E\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\d8aVi\wextract.exeC:\Users\Admin\AppData\Local\d8aVi\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\yZC\dpapimig.exeC:\Users\Admin\AppData\Local\yZC\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e2d3b5683f634fbcee9791b5fc5ab8c4
SHA1a5a2bc6d862f69521238789f0681af5e7f1f78a4
SHA256f95ab39d7ca2f8ef4d5474915d6168263053148cc22f00ed9b1d554103d8483e
SHA51285dd1a63ef03b887e1090de86ce0c7747f67f04fe20768ae37c7572d5a3b17134765432773ebdcb6158baeacbb0202c8630bf8c38ebc0584337c5ddcf0ff7d1b
-
Filesize
82KB
MD56711765f323289f5008a6a2a04b6f264
SHA1d8116fdf73608b4b254ad83c74f2232584d24144
SHA256bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8
-
Filesize
1.2MB
MD52e9c0de8052da7f9afe827cffd75a89a
SHA1e5dcfaac0b2f840859df0783600e1915cdd69a47
SHA256a401509ac40805bcc57d25aaf86e192dee93e179d51d9fb949380dca7407c197
SHA512e32f57dd808d987a7e4804ecfe30f0840fa4dc184b82e7c90f0ac00adfcc4829572bf0cb638691478e06592297c563d808ed4150388104e47585dca675362aa3
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
1.4MB
MD58166897238181cddcdab0784bb9fd757
SHA1742289d7c7192a354a673e2b796e8cd691b43419
SHA256a6429a47fc54843a78d63aa62f27847d3adf0ebf36e7f491563559a0e48223f2
SHA512b626b2825e22105b731f362309e9cf4246c3d3f2c159fbc6e0f07911708c6e58345265a26385a2350d329a60460ff101f263735477a2379f008ede3a8be203e0
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1KB
MD53c9a2505a513966bb75931e206739141
SHA1bb40d68e7e624259e041c6fa424572d2fb791410
SHA25683f13e6ba139b3bee1704ae352527f33b37bc1b8e9b5c397c359d2b38ec3a863
SHA51245755a1862d9e9a9cdfe68316faa26fb19542d7aa191b18ea4d76de7358af19b8294ca1c53a285df08669dfde8e6f58920c085977b442f25cc89aeffc998c65a
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB