Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
20-09-2024 13:56
General
-
Target
edbc2bb8ff32ba555d9ecfb4ebe4336d_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
edbc2bb8ff32ba555d9ecfb4ebe4336d
-
SHA1
30fa3d1d4d7f4993667d2717a8fcd8fa27ba9656
-
SHA256
4128d0f84d420bcd7d2b648660b3cae21bcbf088e8a82f225b65acf95de78d98
-
SHA512
0ed34499393e76d87da9c227a755086147720d36e358bbefe8e0167cbeb7927b843202ba35e8d9eb86da25324c89511d8b4891da46fb59e01dc3a1cd660ee28e
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NHt:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\edbc2bb8ff32ba555d9ecfb4ebe4336d_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\phoneactivate.exeC:\Windows\system32\phoneactivate.exe1⤵
-
C:\Users\Admin\AppData\Local\OzW6M\phoneactivate.exeC:\Users\Admin\AppData\Local\OzW6M\phoneactivate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\JjRmCCC\LicensingUI.exeC:\Users\Admin\AppData\Local\JjRmCCC\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Users\Admin\AppData\Local\AbmuTR1\printfilterpipelinesvc.exeC:\Users\Admin\AppData\Local\AbmuTR1\printfilterpipelinesvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5cf40339c63b5e76f4064b519284c4024
SHA1ce43cb1739df249d2e0c61543cbcb28effc1604c
SHA256d97d79005864f9e956a6aa198825d031b1d80abc4f9992faf5494ec68e52bc56
SHA512b827488823a45cf7abff9a746369d0a17aba0b3a0ef65348d4e4f69c582c3174c79fe067775d2497d4f4c43d826105c3f2abc5cdef47b037f6c04f5b742b376d
-
Filesize
813KB
MD5331a40eabaa5870e316b401bd81c4861
SHA1ddff65771ca30142172c0d91d5bfff4eb1b12b73
SHA256105099819555ed87ef3dab70a2eaf2cb61076f453266cec57ffccb8f4c00df88
SHA51229992dbf10f327d77865af5e6ebbe66b937a5b4ad04c68cafbf4e6adbd6c6532c8a82ac7e638d97c1f053353a7c8a6d7e379f389af15443c94a1e8f9b16be5f8
-
Filesize
1.4MB
MD522a18aeaf839541764ab29fb8e5044cf
SHA12c7fd05d26904f0c4806c786090c3693ecd5007c
SHA25667a2515e83756897cf785fc20a2dcb08e4af2418e6a41fd35d11f1771c13d505
SHA512c09a5f12504c41b4f006ae15429b235dcaa077d75df0790d0dbfa36d24b44051da80499b35fa0eca4aebe7a2355c9b6d65ef5bba2cca0bb68aaa31254244d885
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
1.2MB
MD56940cfe1d3db5e152d5144ad87b048b1
SHA1f99ef1748265bd9b20000ad57f975c3aa9664686
SHA2562ae9a3178cfd1636e874f4801b133a3cf970352f4bead22f620aa4cc374d8329
SHA512581c349f1ae0853a8ba97827ca24a1ceb066f308d360303611cc9b0cf947753641459665fa95528fbc93ab02ab2b58efe53f1fccbe2f5876dde563af370ba8e7
-
Filesize
107KB
MD532c31f06e0b68f349f68afdd08e45f3d
SHA1e4b642f887e2c1d76b6b4777ade91e3cb3b9e27c
SHA256cea83eb34233fed5ebeef8745c7c581a8adbefbcfc0e30e2d30a81000c821017
SHA512fe61764b471465b164c9c2202ed349605117d57ceb0eca75acf8bda44e8744c115767ee0caed0b7feb70ba37b477d00805b3fdf0d0fa879dd4c8e3c1dc1c0d26
-
Filesize
1KB
MD5862ae1306bed21950923a8e394e7a973
SHA151fe31d97300a5189b68206fe1fc75418f330517
SHA256ee521af05f0acdfb4d289fe91d3d73b510c588e823b923c74c1457170061eb5d
SHA51299802110203435348ae3a3f8c7d27b1b9029668e1eb5d5d1ebb798cfd3b5a369bab68f013a637121f3c0211b48ef0485b07b069b279eb38582a2188547e72185
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB