Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 19:20
General
-
Target
f2f48dd5ca9402eba590e53b11d21a44_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f2f48dd5ca9402eba590e53b11d21a44
-
SHA1
cf4bc280cd7180d4fbb2dd42a6bc55b7d5ff7bd3
-
SHA256
67a2f9c4d270e4a3a0d138c9942ffefcc2880639439886a18ba9de001a15d808
-
SHA512
9c6ed03e708ee060e54b07b0ccf475169701a3858866639e02774a4172cfc1b9a5610b668acc9cd36f88cebf8d1827f07e5f55a8945344e09b3bb9b9be3a4503
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f2f48dd5ca9402eba590e53b11d21a44_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4212,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:81⤵
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\6KHesE3\MusNotificationUx.exeC:\Users\Admin\AppData\Local\6KHesE3\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\shrpubw.exeC:\Windows\system32\shrpubw.exe1⤵
-
C:\Users\Admin\AppData\Local\zIp319w\shrpubw.exeC:\Users\Admin\AppData\Local\zIp319w\shrpubw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\nXEH\GamePanel.exeC:\Users\Admin\AppData\Local\nXEH\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.2MB
MD5672763f142780be47a1adaf4b99ea9de
SHA16cbe89c5a463d413e7aecbcf5ad6a5f848448af9
SHA2563bedf391a5d2e505ee99b7d464427ea0ea4e993c403961084a93d7ce41ebc491
SHA512455bd57d081b5180e6c75da19f5f9b8cf02784b1281ddf4aabfb1cc00f47da579511b51e7484345a03fa4ba464c26c8f668591ec3f2b94ad5a9f9e2b5a04a9bb
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
1.2MB
MD59532f9ddc3a72516f08198451332edbb
SHA1ba6b6298e5f78b2e90ff8f1e1a61da5371d2478a
SHA256636e81ac1a794d3cb28844ac5b61d9a103a85a3f3e6bd90c2ba3c7ab1b1cb617
SHA512c68e01688164e0682f9f7ef23b766a524231742ae00fb9148e8a97eea45baa35945ebb3f87310b4235bfc0cc5b56a44f0c4a07eb300f53ffdd10a2cc025837db
-
Filesize
1.2MB
MD5b1888f4386abc3a8ca496e514e8a9623
SHA1594b2c5d4212bdb1cc14b0526877811965279271
SHA256e169313f2e9a5f6200d971e47ada50904a023ae7e18b83d53576b66af5d67262
SHA5123bfa844c9b4e0c81c600efbbe7773f8e62ed14e1746ed15d551e91f0d5bc6338f9f1c539879892e89d4b260116352918b6ec0466e69015048ae0a900a40d5df1
-
Filesize
59KB
MD59910d5c62428ec5f92b04abf9428eec9
SHA105f27d7515e8ae1fa3bc974ec65b864ec4c9ac8b
SHA2566b84e6e55d8572d7edf0b6243d00abb651fcb0cddddac8461de5f9bb80035a2e
SHA51201be043f7ff879a683e53962eec58456ba200d6787ea66581bb62669ae65d5e58a5577cdf23441165f7a535fce1dec933e3ad2465c72172b4a1488b24ce722cb
-
Filesize
1KB
MD545a77a979783c20651a05d5c1b9e73d3
SHA13ddc8df2671285fdb7a0aba3765ab1bffe822a9f
SHA256c88f59359d175e560a401ea241c4352df525f9e2993715efd211d10bce37e102
SHA5128e8327324906beadda3d8d9a8ada1547166570caa01737eb4f08ade3ddcc7b3d46fca3a1ef298c7be4845b6e5c5decab7c9b0886533c8a29dc42919bc6fc1a4e
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB