Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 17:01
General
-
Target
ebcb62508d4e535105b49f6b45d8ded7_JaffaCakes118.dll
-
Size
987KB
-
MD5
ebcb62508d4e535105b49f6b45d8ded7
-
SHA1
9f38415ba19244d0464092f9b6a0c0d8e87072c3
-
SHA256
e8419cca0b781e6ed1d9fa6ec25ca11ca48c7e69665891729fd86ad5025811c6
-
SHA512
37cd1a593852b6d7a75f86f32bde60d4976f4bc87a0d5a89061004050a19279c6bfffb925195ac7a9ad2b31fffa8eb1b3110a1e5614bf90c04732e592e19e31a
-
SSDEEP
24576:kVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:kV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebcb62508d4e535105b49f6b45d8ded7_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\7ZCf\wscript.exeC:\Users\Admin\AppData\Local\7ZCf\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\jZb4\dpapimig.exeC:\Users\Admin\AppData\Local\jZb4\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\rgUnV1\psr.exeC:\Users\Admin\AppData\Local\rgUnV1\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
988KB
MD589d01cdb211fe35e964f2bfcc2d70c1a
SHA15f12215a25710d3b059b773e0d6f87893f46e09f
SHA256b5c9ccffe2d55158d607e445bfcd224c2abfdfc480edf2477257981ea081560b
SHA5122aefa0cfb718da69d47c3a08fd123415bb645a6212158ffebe69bbd0550234455d86757e4d13bb13629b0fcc28face4c13c13462c2656fbe9388e65a6024ad30
-
Filesize
166KB
MD5a47cbe969ea935bdd3ab568bb126bc80
SHA115f2facfd05daf46d2c63912916bf2887cebd98a
SHA25634008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
SHA512f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
-
Filesize
1.2MB
MD5f4b600b50924a0df93c3892679c519ed
SHA1e118f11303ce1b1d568973a26f887a56231929cb
SHA25630448f35c6712081c902bfb93972b62293bfc5ce2a0c93c3e3068c1edcb525b9
SHA5125578859fba43fe2a97f59b3032ba3ee1385594cbc98e7e40fe237dc0448a6fc9624f212d3efe9fb192be128de4d7c9e79428761b513de98dd13ba834e5a486d3
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
988KB
MD5c47bbe61b359f000a9ff0a7f0b72ab4b
SHA12d452a01238dd520d06ce1ea3d51a07b3b9a593f
SHA25628f3b63964918251a73be7190e6164ac949ea522de859acfe10561c422b0ebaa
SHA512badf50dd7fae0454c3bebcc67fa5f88435dbc685cd8ccfbc653ac857d474a0027b2e16b7129260524899c6608d9400e0989c29b38ea88bd6c1826a6eca5155c1
-
Filesize
232KB
MD5ad53ead5379985081b7c3f1f357e545a
SHA16f5aa32c1d15fbf073558fadafd046d97b60184e
SHA2564f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f
SHA512433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0
-
Filesize
1KB
MD56f643e269a5f0689babce2319047651d
SHA1237cd6067b30f63c57a893e32ebd6747be76f82c
SHA2566da0c8f74b3d5b16fed7f19be81da8609191e9f71893942d2d4d5eabb2e55bda
SHA5121b59d5be64645c9a04e64826e31487276ad3a81247bc1a0ce0db2375c902b356a4fe1968ff24e46af2243468f6941ea93f6f987ae983f6103e1a7a26a832a2ef
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1008KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB