Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 19:42
General
-
Target
ec0fbfbc9d92e4357791f2f1613571eb_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ec0fbfbc9d92e4357791f2f1613571eb
-
SHA1
ac4c84d2178402a2e6fb29b3bdb6178495161f11
-
SHA256
a638b49731c356434985d9ef68e10b6def07bf5b398059ea17c2cf8dd1b9f1cc
-
SHA512
d9d1c1502ae4774d7eeb8ccb3315ef41a40e15c5a7644e8fda521ec94bf6b9315efcc0ed8c289f716fb143d2c2975f76bd29e4963d8c8854fe303c61609a14a7
-
SSDEEP
24576:WuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:W9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec0fbfbc9d92e4357791f2f1613571eb_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\XRfp\usocoreworker.exeC:\Users\Admin\AppData\Local\XRfp\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\nZpy\iexpress.exeC:\Users\Admin\AppData\Local\nZpy\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\QukiLDv\OptionalFeatures.exeC:\Users\Admin\AppData\Local\QukiLDv\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
1.2MB
MD519e0c798e79e772e44a829b6cf233ec3
SHA1a01b9dba7915672f9bc4b2dcb7cdc76f62d8cfd0
SHA256adac627310ce7d1d3b83ebe2c2f51790d2bcd8d754046e27f5d9a07feea68b77
SHA512daa79278450126014ad03de5a4a98e7343cb078d38af6223813fe8a67e61f2e9687975a1590f2f9c018dc402e04a3e0a38d60128f9071b1cf94ad227b3a8deea
-
Filesize
1.2MB
MD504db46050083f7e22b03ae2b1064000e
SHA1e42d77895de83a6c3255c2b011e14457ec787ac2
SHA25651c359305c039840ce7a40df954328820c9a39480294e42213d2d1f7ad0ad1fb
SHA512046110d178efb58fd4e65af88cfa78e43335cd6b672c0f37f90379b3eac7d4c8974ca5c789edd525082bdb24c8583cd764aaced9b6f6769775aab7c1b47be57a
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1.2MB
MD5c988ac3be67472606f66f74db9cf6f49
SHA166c93eecedc53ce06296194e496ced74c2e7b253
SHA256fb9204814d80443d0d5281b5a1cd517a39e3c6aeee67744094b688b224b5bd19
SHA512f95ea978f93a76ffbb1f497bf6e281deee30b34afa21b2cdbeeb026823cf7d782f07f9c3bc828905d9da8ad5e2a6476dacf9b419d6fa7660f0407bd650a6981f
-
Filesize
166KB
MD517b93a43e25d821d01af40ba6babcc8c
SHA197c978d78056d995f751dfef1388d7cce4cc404a
SHA256d070b79fa254c528babb73d607a7a8fd53db89795d751f42fc0a283b61a76fd3
SHA5126b5743b37a3be8ae9ee2ab84e0749c32c60544298a7cce396470aa40bbd13f2e838d5d98159f21d500d20817c51ebce4b1d2f554e3e05f6c7fc97bc9d70ea391
-
Filesize
1KB
MD55e501b1d703a851661f3d7052e7a9271
SHA1cf3255b10a82fef79691740b128716f2dd8ab7b7
SHA2560d028c8e47a5d00733b81ee372097a726093e4c0a338d287128f0fb68655ad7d
SHA5128a4e3216ea8bc925e58ba9aac63432a8e6a7eb28f160fa3757fa25df5e12bda02557163da52ae25816e7893605574212e0a42194b7a11c81d0e4994ac3416235
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB