Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-09-2024 07:38
General
-
Target
e89fed8bcadd8c09505de5a77f5869fd_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e89fed8bcadd8c09505de5a77f5869fd
-
SHA1
73b46bfbcf230c1f0a5bfe6efe53c43b494a8c25
-
SHA256
71e81df6b6a1662f36f6dbd56571d345bf55f342d6deb464c33c2c3cb2c55d4d
-
SHA512
8a0185e05880d5979b392bdb02f15c6f37b7b8dbde337f71f6e41291f05d281b222a9d9df31965f4c2640e299bf0e265da96333b7fc1190e5fb6c0570264dbfc
-
SSDEEP
24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e89fed8bcadd8c09505de5a77f5869fd_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\systemreset.exeC:\Windows\system32\systemreset.exe1⤵
-
C:\Users\Admin\AppData\Local\HhygDQkIF\systemreset.exeC:\Users\Admin\AppData\Local\HhygDQkIF\systemreset.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\jHWNG\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\jHWNG\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\aj3B9CVRL\wbengine.exeC:\Users\Admin\AppData\Local\aj3B9CVRL\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5811fb27553754604ed8df66043c71762
SHA1245e49a82199d4450d0bcffe0b6ce978eb7ac5d5
SHA25670cb0c9fca49e0e27d1d4fbd1095ede40ed2a6fd24dc8875ed1b95cfbbdee5ff
SHA512a96b6806ed27a6675caa48de8b73b54b6e4deb7360b15ff537c9d4a13e8adcb5405285755933a4cd36e824d53dccc424dad71e12c2435c169b1f7092f5c9941c
-
Filesize
508KB
MD5325ff647506adb89514defdd1c372194
SHA184234ff97d6ddc8a4ea21303ea842aa76a74e0ea
SHA256ebff6159a7627234f94f606afa2e55e98e1548fd197d22779a5fcff24aa477ad
SHA5128a9758f4af0264be08d684125827ef11efe651138059f6b463c52476f8a8e1bed94d093042f85893cb3e37c5f3ba7b55c6ce9394595001e661bccbc578da3868
-
Filesize
1.2MB
MD5f18df587f076e524e166b17a940fa178
SHA1db18dfd68b6412428f32dd13118414f5d360d163
SHA256d62564f2f29ca31856e65f749e9c59548e54e782e925fef0b86e6dbfc69e20fa
SHA512f1d0b8de8f11954335083efa7da92189f3d8965517ab0f86daa4479af9829855503cbf6b86055bbba535f2075e28f4405fb80da331c213500a8bf194c1a1ed4a
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1.2MB
MD51e9499d572a1a18f65ad15c392bdaaff
SHA138afb609619ec989f9e6bc5679ffdfaf4d701b71
SHA256e99121932ad00b789d9e3501db3dc647b7324bd2eb1f0eebb8f4af569cf6af9d
SHA512f683d8670ac06cf53418c3188c9aa9fccdf2f6a1f28b64e849f7e68f0a76649a6507d745b368acb7078ed2c138e7e3e013c1746f560cf6b92e43961a05c7c423
-
Filesize
82KB
MD5bf5bc0d70a936890d38d2510ee07a2cd
SHA169d5971fd264d8128f5633db9003afef5fad8f10
SHA256c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA5120e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51
-
Filesize
1KB
MD5c96505c154312b2eca66e970fa95011e
SHA19105441d1c46153f4d73924e8a533410a2c8056c
SHA2561eb7849745b720398643682a27e84d840cfd05e151c5e79461aa1ec2d951900e
SHA512538b96cf7f4e703e60a5c5930e8b38b7687cf1e6316babd97fd0c5bbb1b4bb4deaa7ef529b971a1a8fe96af83035667eea7e8d99d526217b285a21609ea22db6
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB