Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 13:08
General
-
Target
f215b4fabb14768f115195da3c9dad3a_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f215b4fabb14768f115195da3c9dad3a
-
SHA1
8977086bad5f310504bf0c61f36f096f2cb7644b
-
SHA256
c4a179d204f7bb7c4f82d2c0878c3f5cb9ca17fb519dd3b7447e4c3c5b327019
-
SHA512
d88438ee561f9d21017f2099b915cf4b5fd4f03b58bf8b139b721b558f41f061b923e564c5fbb9570c5c1337b986810df91de4a7bb2b7dc160c5c5f6022681ca
-
SSDEEP
24576:AuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nfpt:Q9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f215b4fabb14768f115195da3c9dad3a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\3FJmnC\BitLockerWizard.exeC:\Users\Admin\AppData\Local\3FJmnC\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\GfbU1gnuj\wermgr.exeC:\Users\Admin\AppData\Local\GfbU1gnuj\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\c3Ecgee\MusNotificationUx.exeC:\Users\Admin\AppData\Local\c3Ecgee\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Kh04Gb\mfpmp.exeC:\Users\Admin\AppData\Local\Kh04Gb\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD56d30c96f29f64b34bc98e4c81d9b0ee8
SHA14a3adc355f02b9c69bdbe391bfb01469dee15cf0
SHA2567758227642702e645af5e84d1c0e5690e07687c8209072a2c5f79379299edf74
SHA51225471b0ac7156d9ee9d12181020039bf551ba3efe252b656030c12d93b8db2648a18bdf762740f2a5cd8e43640e4bd4e8742310dea15823fc76b9e1c126876b8
-
Filesize
1.2MB
MD584fbaee710d54dbcd8d1c46bc4c5569d
SHA17ffc2b902c67029becc0ae21de8984c4f334702f
SHA25623cc6773304c8251b3dac52bdc472d3e798bdf737ae956c12f80ab642408b765
SHA512945f183dd82da058176b26eb8f187fa978eade78864c6ba810d724346c7defa1fd86a3db1cdddfea8e56b2b99818a825f865c8dd42b5159f6be0d2c8ee8fdba0
-
Filesize
223KB
MD5f7991343cf02ed92cb59f394e8b89f1f
SHA1573ad9af63a6a0ab9b209ece518fd582b54cfef5
SHA2561c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc
SHA512fa3cf314100f5340c7d0f6a70632a308fcadb4b48785753310a053a510169979a89637b8b4fedf4d3690db6b8b55146e323cad70d704c4e2ede4edff5284237d
-
Filesize
1.2MB
MD5ce5f6384ded5fc6dec1145cb7a26db12
SHA182cbcd1455337919556f6e73162a7d8156b0b487
SHA256e4e6fbeeea43c8cecf8a995686c2ecc53635c5e9e14588a64e02473c0d0a31af
SHA51251214e4de7a04a254d3cdab5cf3bd2252cab44fea191b50bcd008eb4959b3ca1adfa96f4c50d117ee4491b0e494043d7862d8d62b8138967b29fe5f9ccee445a
-
Filesize
46KB
MD58f8fd1988973bac0c5244431473b96a5
SHA1ce81ea37260d7cafe27612606cf044921ad1304c
SHA25627287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e
SHA512a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.2MB
MD59651386b648e1198a8e7ca4022725142
SHA162931ddd911ab71061680652f6652d692f5ef4f2
SHA2564611ed8256796a3622ea3cad5474b9e424bff96c45834099a395ab96d3fc2db2
SHA5124a0837bd253d6eb4960bc386a9055e39bbf63073a35b4745ae0ef602070bff46cf27576d8f2f6053ed6203aa481cd8a7e92c51230ab0be41d177215c8a86a61e
-
Filesize
1KB
MD5c631cb059060d0ea9953e9e54e17b21b
SHA1293ccac25761a145ff7156c8e24ec14694866f59
SHA256603459154ef789d6909bcdcf7c24713b5cb4be923e22e8921db88dc785f2242a
SHA512a4a4c94cc701333945a21ec05214c306590262ea229a3ae3a72d2d3d778141e88f5b2e0b369e44f45480f9d0c1c1e73a016d5f2fed783111e36869ffb1a47571
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB