Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 01:21
General
-
Target
f4dcda795d669eadc3e6aece306f5edd_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f4dcda795d669eadc3e6aece306f5edd
-
SHA1
11264496a75d446d6d6f443d8200caad04340ed9
-
SHA256
1c173d1937e8af89b502f278fb6053f5a1823663ff45e9d9b174483c5d7b46df
-
SHA512
93b7ade0fa90d5f7b0db616d79c498b43aeeb92de6e264c7908124c78f8b57cf5554e26ad36e7c08a36cf6c65207760eb60846c63e215dd3852226aa6d9ba165
-
SSDEEP
24576:luYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nipt:f9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4dcda795d669eadc3e6aece306f5edd_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\x9Gi\rdpshell.exeC:\Users\Admin\AppData\Local\x9Gi\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\pel\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\pel\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\L1EPN\PresentationSettings.exeC:\Users\Admin\AppData\Local\L1EPN\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD5790799a168c41689849310f6c15f98fa
SHA1a5d213fc1c71a56de9441b2e35411d83770c01ec
SHA2566e59ab1a0b4ac177dc3397a54afcf68fcea3c1ee72c33bd08c89f04a6dac64b8
SHA5128153b79d4681f21ade7afe995841c386bff8e491ad347f8e7c287df5f9053cae7458e273339146d9a920ceaa2ba0f41cc793d7b2c0fa80efbb41477d39470866
-
Filesize
1.2MB
MD5d639e1cb206ad18e3475fff5cfd04acf
SHA1e8706db05051cd1be76415c038ae2741008e372b
SHA2561240fc04f5c9279655f19f588f16b2406b559a654d0efa5c225c4ecd36c9b6b5
SHA51225455723c6a14a3dd661a77daf411b146ff0710466313adf39ac83108cb9cec0d460328ef5a888226661039f942e4837f69e7f0dafc09e06e13ac07d369912df
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
1.2MB
MD58714b53cac2c5adcbb4b3b4abb3d4bd9
SHA10a19eaad1d23017e657bbe7c533ab6fd9562a2f3
SHA2565c79ec51eb686f4055f20ae2ab1f3d48bab57f20108fbe0afc8a869ff1d66714
SHA512953f391dc01ed9c5551a5a1d92a95051b5c319fa05f2cf205ac4507661213d98d0da66d6efabb52ec4cedb266d721e9d4ec0407aef521528938574777f7152ae
-
Filesize
1.2MB
MD569f72333f1732138b7c8b79f3793543f
SHA1aac47a955572572e69f757fff6e7618371a1b1f0
SHA256ec8953a88a2e962053db4bb194a8da5e24383460b4c6b80216351bc87a9f9b10
SHA5126b7671f630d20d65a161e88e8de34c777dba3dbc5f28f3172e13f7140b0b5798af37780e03ac329188b6b582305e99c3a76ea5023aac2527f78b8b73ed5ee656
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1KB
MD57b763148fc19efbd49532e5b308eedf4
SHA1ddbcf37ecee2f684dd96dd1c358ecac3fe10fc31
SHA256ff9b0b7661bee93dfb3120f475730a8585bbc0f0c23beb56c1bf351d0d2ee510
SHA51215a37be197b814f0d3323fc6287c8f6cb54e7377ad90b5b4d13314f355695d2bd350aae701203e164356427f7fb04f86942185448754e6bbe0f5c17e7277dab4
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB