Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 03:48
General
-
Target
ecc94ddcac7f889fba06679317c767a1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ecc94ddcac7f889fba06679317c767a1
-
SHA1
75da782863c7e30f45939c0711057d37483bd437
-
SHA256
e06c71d9c6e770486e02dc3dc6fb9d8d640c3142b625d7a4e8ca0d99aff3b944
-
SHA512
f096735220bc58a172bc362aae448ac3e169418fd76a247c9d20fc814d93e8fde44e2a99e9a5a4ccac73b41dbbca3849bd7215cd4fbe8c68f26d3a512ec9444a
-
SSDEEP
24576:FuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:/9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ecc94ddcac7f889fba06679317c767a1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\YT6\AgentService.exeC:\Users\Admin\AppData\Local\YT6\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\phoneactivate.exeC:\Windows\system32\phoneactivate.exe1⤵
-
C:\Users\Admin\AppData\Local\F6KmPEHr\phoneactivate.exeC:\Users\Admin\AppData\Local\F6KmPEHr\phoneactivate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\41m\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\41m\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD52d1a832cf98688e8df6f01e92b588ebf
SHA1cf443a8dc0b5bb5c454a36d012594799d5f1759f
SHA256f495a859589df224e04d4ae18f666b259ddd3e1d808ce2aa57f0736d77615311
SHA512ee8d13777b3d719f735f0f6c57ed1db3ab7c46e4d8991fe4e5518c168ceb312a5d94113ab7d03ac1b7540d46ad7bf5e058ea8ef2bc9da3bef1e9aa5e6304c493
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
1.4MB
MD5b1ee4cb3df38d27dbcebae866e27247b
SHA179281341334311a7d4e03a122209c1ddfc151474
SHA256bb10a34cc008b5bdb46117842bfaff9811855776ade8710cc65f98f3e349da1c
SHA5128dd1a11185510c9f303673aba0ec06107da445df4c4747fc52add2bbe829404de499f9659749727d449035e675955310500f3549332c2d9490ee528c3b5b327f
-
Filesize
107KB
MD532c31f06e0b68f349f68afdd08e45f3d
SHA1e4b642f887e2c1d76b6b4777ade91e3cb3b9e27c
SHA256cea83eb34233fed5ebeef8745c7c581a8adbefbcfc0e30e2d30a81000c821017
SHA512fe61764b471465b164c9c2202ed349605117d57ceb0eca75acf8bda44e8744c115767ee0caed0b7feb70ba37b477d00805b3fdf0d0fa879dd4c8e3c1dc1c0d26
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
1.2MB
MD53d38d8b1c46c4c24d93d81d87fa45d3d
SHA1239b7c8e8df68456aad946d084d67144e159644c
SHA256e74cd77bc8b11d3eb3d8f4d0443537ab52b43542e03701fb73a8019dd1ced4f0
SHA512cb7011ac4306df87e5dd7f98fc6886b77c367a9c97971edf0d463143819309abaf105e1982538bb17a1ac9b0443c6702329ce9531078bb6ada7ecd14842a22a1
-
Filesize
790B
MD53d4a6f99afed261d62bce9eff781c999
SHA12a8a0d80e0d78ea3867e0ac60d584fa371c6aab3
SHA256c422576a0e33cf859f3b15d59051280eb11cd94e9a5751a57d831cb96c5b4d37
SHA5124295ae72cf7c064977100618757f7a8130d95371b2e9847c560633d7e3ad1718ce1d85659fb8b0e59ea07a33a43fd0924f634aea672713cc3188e1a8dc17bd2a
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB