Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28-09-2024 19:54
General
-
Target
fd08217e7bf39060422120e0bf0c3c55_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
fd08217e7bf39060422120e0bf0c3c55
-
SHA1
30b0479d71ea93a53e6ba7dc47c5f3cbf226de13
-
SHA256
71589f5444e986a5cb4bd2043518f4209f7afa633c826b3f8471dba7a47a689f
-
SHA512
c0aff810372c653b505c50abd8a21960dc951798102cf726373178f53fe7cf96d33f97baacd0b98e34eee4fa3416243fe0af4f3ef9f1ff5b3ba6eb194fe98208
-
SSDEEP
24576:suYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:E9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd08217e7bf39060422120e0bf0c3c55_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\6PDPA1GO4\isoburn.exeC:\Users\Admin\AppData\Local\6PDPA1GO4\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\57UPw\wextract.exeC:\Users\Admin\AppData\Local\57UPw\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\T9t4h9j\FXSCOVER.exeC:\Users\Admin\AppData\Local\T9t4h9j\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD53c329e0f4ca4d06613c6752bdbb28ecd
SHA14018a721af5d8b1a6a9173d8b0786ecfaaa18094
SHA256ef77d35c7cf31783d698c9fd4e14c3f26056b3e4894f9212ffd7498af1c6371f
SHA5120dba2beb26e3aa117e90b47900878791d2d4321cecc852186fc7a6291637a582983686cbe81f698cbf944f743e87319caa597a50c27b95c4b43fb8363877e5c0
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
1.2MB
MD586031b544967a605f9d8de46fadeef5b
SHA17692d07ef1ed7bf245e99ebbca468cd8ed008435
SHA25601191c0308ff05105dcfa1ccd9910daa42087528eaaaf84e2f6631d5ae518044
SHA512d8064e0fd0ecc0bf2657f3cfcfaa3b2b3d38e87fbfb0083b397eca8ce370d03efab71b0241f2ee30d2d94956762189bc67e3045b8f7453e27bc6e11eff1db438
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
1.2MB
MD56dd7c80a7250f9d1c383ac58032da101
SHA1318b511dd576af748985ffc71d7d64b796985046
SHA256ffd9dab6ab71c9af391370340cc639c6a13a8ec0f29bea3cbf96f6ff75b251ca
SHA512f879be1048893fe6dfbfc00acf3390f22fc16977d94fe280013b1e25c41320e36606570982dd34710573dea521f3ee331c3f484fc87807f7f0eec2b1e91b63bf
-
Filesize
1KB
MD5ca9b5a9c53737abf1c990e9dc154bfbe
SHA12e96456385c518ef14259a3326e65f89a5cef585
SHA256620e8ae9ad912c634a99193a5a2d76e38171c12eaed290b1f2fcb508f5ccc56a
SHA5127960a0bcc70e644ead5f3417de7c82245c45a91701d9a3ecb7eba809330d5adb7a9b8100dc8901de8a6358bae3209b57e02e8d41196a60dbd63ba29452fb8f12
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB