Analysis
-
max time kernel
149s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 14:05
General
-
Target
f8881045a1ea4f61e672b9e6edcc4a8b_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f8881045a1ea4f61e672b9e6edcc4a8b
-
SHA1
aebacdb61c914143ba4160c44fa458be9559f358
-
SHA256
505e175a4ff5d40800c0cf4a00332b8230504090a9f24b1f255d86770dbb23b6
-
SHA512
b683a09a09942ba5e0d16ed752d81bfe72cfa8f100d9ec7dd6bbfb98495cdb26eb383beafa16e777a1452f9758cfe0305545381cbb5c32019119926440741992
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f8881045a1ea4f61e672b9e6edcc4a8b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\x5FzHE\wlrmdr.exeC:\Users\Admin\AppData\Local\x5FzHE\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\TFTNumXH\wscript.exeC:\Users\Admin\AppData\Local\TFTNumXH\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\PAmSce68A\wextract.exeC:\Users\Admin\AppData\Local\PAmSce68A\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58a1a6358aa9f5854b9b909286814d827
SHA120985070220bc1d26c00e3d0d7459bc47ba87eaf
SHA25617206a4096bd14f740f6a611b52dee0b15b427b1841cb381273629e6aca19baf
SHA5122791c5806913eadc809e4637c8b597237d1cc69b504249461026e5d44474d9c7e69a06c3fc97469b3f615823bad02fe08cd4f3f26af4ab6aa932a395e31bdb4b
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
1.2MB
MD50254244b4c29669b3a6bcb9a6507c0bb
SHA19f73f3ffb419066b99c21e860808edb03afbf6d2
SHA256668e40c61a4a6c4e6a3350c230487c81a893969b1f2470cd9fcc4526f8f7a459
SHA5120494c345d88e61277ce0908815fb520bc0d54941b2b8efdeeb0e24aacd4e2c711279b75e92d9e5ed1d33324be9210c8e55efc6117cc420b86d6086f5a9400caa
-
Filesize
166KB
MD5a47cbe969ea935bdd3ab568bb126bc80
SHA115f2facfd05daf46d2c63912916bf2887cebd98a
SHA25634008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
SHA512f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
-
Filesize
1.4MB
MD53e339d438637ec44d1130c4f47956c55
SHA17c3c397f37fd75a233c078f107a8819b468c8ad1
SHA2566f9fb37a27387803ccd758ac36fc91694218b8de0256cf4d9a3bf13d49dd9929
SHA51286eb87bf31433a0ee44fc911288319783eabcb109bf2ce1d1aa6f4621155fae79ed712c04cea44cd06b48569e225b99679ef94d09b403812c5166a49fe7903d9
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1KB
MD5709c63af57e0f6ecbb9a9c7dda254e00
SHA1aa0d5c0cb5072c1d382ea3983e020e5e480345d0
SHA25677f2be10e6f28ea8b0f8b4e5696439ca526d1f00f7f83daec5c00c18c006d221
SHA512cf4fb4a3b48936f03445ca43250afbe0b75a19efe381ada8b0067874501ad29b8df5193ab93537b90004f8f917d03de2ae08a0e87047d7d24ad8b5c111a46b58
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB