Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-09-2024 00:17
General
-
Target
f963cdd13e8a02e085ad96942c7b697e_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f963cdd13e8a02e085ad96942c7b697e
-
SHA1
c45bbdcfa0d01b667a899c580eaf672c17f6476e
-
SHA256
d2b8767e0bc73b401800438a4249a81a7fc998d126f98ee574779b3629569e9c
-
SHA512
442f9c643485bece188752fbac53aa9c2bfbbefc273c1b60e37d0e9625fdda2caf3ade1ebef99acb0964f015203c9ecea72cdb4250cf328b88b5ca8419a0701d
-
SSDEEP
24576:iVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8v:iV8hf6STw1ZlQauvzSq01ICe6zvmU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f963cdd13e8a02e085ad96942c7b697e_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\ooCDgYP\DWWIN.EXEC:\Users\Admin\AppData\Local\ooCDgYP\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\s6L5OX2AA\CloudNotifications.exeC:\Users\Admin\AppData\Local\s6L5OX2AA\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\UY6h\perfmon.exeC:\Users\Admin\AppData\Local\UY6h\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD508f9849399f64c16d61833fb5cdaf1bc
SHA1546dc060b740246949e25118c92ab72068ba56bf
SHA256779e3520016357113fb64b97ae1805db0c2287f19b1bc15da6769bdcfe9c116b
SHA512907886d9a27d2f792c48fefa2b9f38351a6056bd151028381cdba1d4bb0758c47ccfa981116394d00897443941be948a59bcf99f16996afd37084c77df60a5fe
-
Filesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD5c4d99fd1b28e295b6459d23687da3047
SHA1dd1399715a349d67ad95cb27748d930447694527
SHA256e0bca955b548c28d6405209821b5dde8f799685a65fa3522cc0239db5d74a60b
SHA512f10a2c1962b09415bcadbc6e86645970981020bff464632ca617eedf24bb15082353263c10c0d39008f66edf41ce1f77915aa0e2f248ab1fd2a76f10a5de8564
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
1.2MB
MD5c569102f37640630bf08fc51c495484e
SHA1fd694e105bc38fd5b25fe3123d0ee9b9b59674fb
SHA256968452d9b85511068eb8c080b1bbf7a084bf586212164f7629909591edd3f12e
SHA5121b0f62088be3d3a78751a00310890aa972bcefca3b9145bc80a1d6aa64045edd93731f7da58e77f597083f19e0418fc0f4ff6ee9f5a038a51c9ba3eef83b5087
-
Filesize
1KB
MD5834151eedd9de97a277645e1221d7bb0
SHA1c7bbf535cf4700925ec362df5853a56fcc87b015
SHA256af28fe069a8990cfb409ad1decff9d33d8d108e9710ce7f2734079bf4ab2100b
SHA51241529cf8d78903cd25cc587475c9fdd633dae29b413b6d14fc60074a1252e43b1d0244f4b6ff25ce0f998fbcad1ced1b051008c7662c758777d6259164d1c6ea
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB