Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-09-2024 08:37
General
-
Target
e8b8a0027996e15a3fd8e3bb55f082f6_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e8b8a0027996e15a3fd8e3bb55f082f6
-
SHA1
fa6157e38d9e14774b12b52d599b516e05ba3ed6
-
SHA256
77ccaeda8a23dc24a8d57f41db284d1cadac6c9ba46781728fb31e0102eb874d
-
SHA512
b8cdb6f404cf34f05afcb5a948b9ba1c3e7f615cf9f1beaddb6ff3632e0d00187ed97967a56eada005c2862368c50f4aeb08185ca8c0136bbfbaa7b85305f242
-
SSDEEP
24576:PuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NMt:x9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8b8a0027996e15a3fd8e3bb55f082f6_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3956,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:81⤵
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\W3ijm3d\dpapimig.exeC:\Users\Admin\AppData\Local\W3ijm3d\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\aFqptdISu\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\aFqptdISu\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\IhNa\MusNotificationUx.exeC:\Users\Admin\AppData\Local\IhNa\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.2MB
MD53c0766433248fd28e1b781aad3854c2b
SHA1fea48611ecc4fc6ab1d5ab94e993dbc382a58620
SHA256e2321ab5dc250e98f155f9cd10942117ceee1030d522b8f95dfb96fa7e703afc
SHA512bf30511c31dc3763859b7c07477e7efa58e8b92305c763aea9ee2ef05165d54ead5d9a718a7f09be4f1928e378af86db04e45ad83327a4a4b8462d95e960293c
-
Filesize
1.4MB
MD573f4c08f5337a81f04bedae34b4516ad
SHA1d6d1c28c471621bd50e4b83f22f1b7b2d227353b
SHA2569ea508ba664f587d816e922af9937b9543bff0dda61a9c5cbd6f5e068b4f10f4
SHA5128b1239d327bc39f951d1872843234b33540567e23fa26acfd3389d8d3155cc8fa304fd244b160086a4c3a03d79b8b29637e8cab4d2687298e0914d78d17e9517
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1.2MB
MD539c548897ca4b80c53d229c413fcd53c
SHA18d46a79ffa8cf921085f24c2cd807b41e4e3fb11
SHA2566ef31105dd9bb75b3682154dcc63c8c61ad065de57dfc406fcb02b304dcc09f5
SHA51237daf79d4e09cd9e61b135d8f96d54e620b376d1318245deb25000e274595c5b03c6d583054fe91fc04235e79639c2d8bc0b4bb4b3365ffd3a0de61de3a8347d
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
1KB
MD57e4984f6996ecd70719f5bb6f7a7d590
SHA1cc18bac9d6f846f838f8eb084b6fb432a82be2f9
SHA256e3d768ae442c7629de4779c964813479ca5d9f1a8f875613afce57ff283f7399
SHA512cccdc854a11f4070010484e375dbb4eb0a53de93fd36e1860e62c838cdad07d583caa162569121ed0aef93f104588da64a73f197f39e7c6255a8997e24eb856c
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB