Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 06:20
General
-
Target
fdf4a24f88214b0a4f02a8669a7c5ff8_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
fdf4a24f88214b0a4f02a8669a7c5ff8
-
SHA1
d187ad8ffee9d34bbb8dafc787dd3858fe47cfcf
-
SHA256
a151a8221a96d0ae5359b263a82cdcaf6bc4be7e3272f8c2edcecd8691b7df7f
-
SHA512
771d54ff126bff1ebc52614c9f62f639f6fa212cf95da56b6bb07df228b88eef30ba7ff2b0d9bc45209b946dec201b47436508b5cd60c21a486fdf2f33854822
-
SSDEEP
24576:vVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8j3:vV8hf6STw1ZlQauvzSq01ICe6zvme
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fdf4a24f88214b0a4f02a8669a7c5ff8_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\1wzid\isoburn.exeC:\Users\Admin\AppData\Local\1wzid\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\BrAc17fu\dialer.exeC:\Users\Admin\AppData\Local\BrAc17fu\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\7rFE9gQf\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\7rFE9gQf\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5941f00a702554955669f1051f39405f0
SHA1e914aa2f40cc067f336dc922724f9cbbe5854fbe
SHA2568ee0cceeeb050bedd3b46f7fe0214721a4fea3f372c2b41c65e5a47fdb85b2d9
SHA512c39e759730ebb8a4be0177686482fee00ac1398c49a98e8378d1eda6ba06d2782bc7e2efaaf3d72409c3905aeba36fb75435b5ee37408932949c24426f449285
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
1.4MB
MD5cd49b021bf125907efaa1a90eb5a43ff
SHA158aa77617902befa318ba24ba4df3f336d6dddc4
SHA25681df7880798a8df70a998b3c9d4be22e1be472aa7c89327a428adaaa68392023
SHA51296b5b300a4c61c5c5a2db102b5426f4bbb155d4da8f3a1e671b95aaf8d699dfcd48056514a02054a08dff9af48642c279196b75c10bac6b5a0b5366d7668d1ce
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1.2MB
MD52e8d78141d5766bdb55e7ed3fc4cb50b
SHA1f43fda501ab6f36f767dfaee3cac0f0ca19cd48f
SHA256a5bfc7d1e514014d510197244cfea7c4c3f7fbfce868eeb10a0ba820530600b7
SHA5123fb289cac9f3fba6bfb3235585ce45abb89b35f72fee2a9e61550a5c7a61ebaf503f2017108b65670314182a2563c047d54f6ecaacf54047e36864e854983c22
-
Filesize
39KB
MD5b2626bdcf079c6516fc016ac5646df93
SHA1838268205bd97d62a31094d53643c356ea7848a6
SHA256e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971
-
Filesize
1KB
MD5dbdca524f89bb08fda83631ed52e33e1
SHA1874a02ca3f5e6c08f5ba977588ff58ee31e77fcf
SHA25650d5698106f1de9ee9e80aaab78667e85f48da7c0f1c928a9120d01987a5086e
SHA5127924116892d551a23c04cf5903844ea78d5bd08f9fa3acde7913b87693fc22866cb83dbb9c925ad66e3debb938896db7c1ecf7662d6c395cd4005e869d3c6f5d
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB