Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 00:40
General
-
Target
f0f02efa0024435c1edf094743b7cdf6_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f0f02efa0024435c1edf094743b7cdf6
-
SHA1
57dfa6f63f794f897e53b0eb582ef76e1a646ae0
-
SHA256
f5c4a8d100074c8177cd39eb29e743cc48d5cc1b9eb17773c79b1465c0f0278d
-
SHA512
196c9db8e6c57c7c6680869c4099c10b844cea7d73b6f9eb489e3948344a0870f498a7f64750bd60251496195a11ccd99359250fee16b8ea424fb2c93b51cece
-
SSDEEP
24576:NyTonNVlKTt/Q5ECvVP7hpJMvjtKpvPf9+m6kLRqgSyI:NyWRKTt/QlPVp3h9
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f0f02efa0024435c1edf094743b7cdf6_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\GLpMm7m\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\GLpMm7m\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsAdminFlows.exeC:\Windows\system32\SystemSettingsAdminFlows.exe1⤵
-
C:\Users\Admin\AppData\Local\EwWU\SystemSettingsAdminFlows.exeC:\Users\Admin\AppData\Local\EwWU\SystemSettingsAdminFlows.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\86Xjgih\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\86Xjgih\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58400b2e19900a49ac94a86dd8b934a47
SHA1e36bd7ff3fc7b059302883705bccfbfa922af75b
SHA25682c6bd49095593eeab037f5068ddc04ab57693d2153809ea7d9026875edbd34d
SHA512f28744e475df960ce6c7358b677bbda026eb7e57ac79211b9fa61bfce85715a4159fea43e2bf6a9716a34db96972e5f10a1214da6217fb4e697d1f9fd94d3345
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
1.5MB
MD5bdeaeadd9a41fbe291f14b706736c081
SHA11ef618710cc05b96b40bd5852bfe0303875b7ea5
SHA25632ef75d8e2490fff60fe1d9aada1ecb0978623f42977a162133e2a455c7f3a42
SHA51241fa5696a934cfd01c5e2ee3e74d8f9ffeab46a14fa21ec0435835d88b8df157fdcf1320ae36c0f0f7cc87b1896437dfa0047de06b1d5980bf07c6ef49cf8702
-
Filesize
506KB
MD550adb2c7c145c729b9de8b7cf967dd24
SHA1a31757f08da6f95156777c1132b6d5f1db3d8f30
SHA256a7a2e7122d27308df37b7ab718ef3ac239e4216669f51331e34e205f59fb0aec
SHA512715b4c93e79e896da1cf86cf4455a84cba1aeac34b6fd72d2afdf203a2034f6f8fac1d6501f0dd277a17bd1d7ab73ddd1887e01a99f2d26f39efeb94d0aac9b0
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.5MB
MD509b17bd66a1176dfa825abea67e7bf10
SHA1a6134664d494b9f9b127e5e5be18a0326d76fe70
SHA2569fa35e0973be475daaa07195bbcf414fb61b5f51950f510f8cf7bb9894076fc6
SHA512e0886fe5742512e809e239f878caae9d6d4ca032b2a651c35ac849b9d1f4fe93684915f986b5cf8b571092131e17a12afa040ea446ba9c8905021611aabd5835
-
Filesize
1KB
MD573b6903ae261fa6dceccaa646d1b3039
SHA170be39d30ea1fd58552370f5f886b66c8787fa8e
SHA256e71053417df0623d133c2fb24e8ab3a2d47b2933a268103dba46c72c4c258683
SHA512a89fb8b79be55f7bbb80f2518317284ab3006477203c782cb33ff550ebcd76586b23458fc5a05ee9a22065d62fc4d1fe691231694454703ced0cbbcd1b36738b
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB