Analysis
-
max time kernel
149s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-09-2024 12:58
General
-
Target
efd947775c2bfaf5633f4b00f3035c93_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
efd947775c2bfaf5633f4b00f3035c93
-
SHA1
cef407cc42529ff19d9755c113c15fea7fb2c8c2
-
SHA256
c5b3d45cf71bfd6e89a73ea63c7afd688c327595456df2d1894c336006261ece
-
SHA512
00aa40aafc047ab32d91ba504314548d6dd1aad286cc4d5f6aa447442df51b740e6c299c082dec75997d3d25423fc28df0ce3a8012bf280dc9d7a6fc428a62bc
-
SSDEEP
24576:1VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:1V8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\efd947775c2bfaf5633f4b00f3035c93_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\rlE\omadmclient.exeC:\Users\Admin\AppData\Local\rlE\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\OL4EL\lpksetup.exeC:\Users\Admin\AppData\Local\OL4EL\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\fpAslJcI\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\fpAslJcI\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5beca557fa0c0550a63aeb0d7ca3cefe3
SHA17e47a69f720a6c7130367b5816e6fe2cbedf1aa2
SHA25683700fe76fb1c09a5f7bfe58bbfef6c436bd1d2101ddf73d559776906e9cbb4b
SHA51264167ea9e8d3bf71d82070b200cde27634273f25ee1b270407fec8099c2977227cbc99a5b9395844b6581b00dba602626d5d5e3f2f18389706e732def5eb6a78
-
Filesize
728KB
MD5c75516a32e0aea02a184074d55d1a997
SHA1f9396946c078f8b0f28e3a6e21a97eeece31d13f
SHA256cb3cbeaaff7c07b044f70177e2899a87e80840d177238eb7dd25b8d9e20bef22
SHA51292994fdb75b15742e33e6d7a499664b722e45b9c160d8cc42d30bc727044063d589f45853692b5b754df6ff0fd21294dc32fed985b153f93f4bcf9f8c89a5bcc
-
Filesize
1.2MB
MD5eb1ead6ab091fb5f935d332074644c2c
SHA195f588dd5ecda84782ab6a69ceec2aa313be230c
SHA2568624e2e5e6e5a5fb65458d91ffa93c65019925661f88f838083a50fb9a3199dc
SHA51267405c08d33b97e8b6f72b079e03e9bda9989a763867a089f814bf6024bb3daabc11725a935a89314b51a4e4ef9d8c53b6b614f63b73bce4cdbb7349b218207d
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
1.2MB
MD5730e92cfa43dc28d6b045762a8a03b50
SHA18ca88337be2642a0dd55c6b93677ce7854a3c6b2
SHA25638fc7cab810aea8525ff17a8472d146889111828b7e32c206abd48af762b15d8
SHA5120a9b8632efd565c5aad421e4efaa4bb5b2a8e23df453290b82f03135c7eae86cc9c99d3e02f501d92c620fdccfed938255d41851e50d0a786a6fd33d5ced2df7
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
1KB
MD5175c6ae46f066bf24c62fd3a5fbf1670
SHA138dee7f596dd9e73ec75935a8eca38aad9f828e5
SHA256dd5e5316071d80dba74085785a2ff3cf09ab62ba04b7e75526ef4fdc0c53fdbd
SHA5127c1a83d3fd689b10e23a5ba09c7f03e1714215340ab31ac45d1390609f7e03db129577dd08908fbe8a02d1a8b7ea43692d4f05ed5b4a5fb369d4fe38a5230095
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB