Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/09/2024, 18:15
General
-
Target
ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ff18e8259190c79d60bdb5e0ec552404
-
SHA1
ffabe6c627e7824f5ff3d10c3716f03a4ae6dea9
-
SHA256
e65d864ac680a40fcf898cb480e6b6eb2406307973a19b5001edaedefc4b3f7b
-
SHA512
30efef42d9b3874822388b4c6a8c196d518fe560cd0bb12b23f0af3ad82da90533351e518a661a91d850b968b80d505fc2ada5c9dd10127c04ab3e157b1fac47
-
SSDEEP
24576:auYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:C9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\dgbla\DeviceEnroller.exeC:\Users\Admin\AppData\Local\dgbla\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\TdVEbpCwb\ddodiag.exeC:\Users\Admin\AppData\Local\TdVEbpCwb\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\mHk\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\mHk\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c37e874ad20a14b7ee2188505642820e
SHA1cf964bd3652c4ab86ac02f362e14b4ee0251d021
SHA256a29ffd0bebb43d9ea68012efcddf0b236a5e49df67a90f7df4b2df45d898550d
SHA5129a972dcf0effab0ae266324cad1b39e58958b150d7d0ed61a2c152964be04af28ff00f1c0af36dbb0ad40e4f82b64c14f60387092ea04448825be813900a6b18
-
Filesize
39KB
MD585feee634a6aee90f0108e26d3d9bc1f
SHA1a7b1fa32fe7ed67bd51dea438f2f767e3fef0ca2
SHA25699c63175504781e9278824d487da082da7c014e99f1024227af164986d3a27c6
SHA512b81a3e1723a5180c5168cd7bb5181c631f4f57c59780bb82a502160b7874777f3eef1ebe1b14f66c97f9f1a4721af13b6fbcdff2045c8563c18b5d12540953ff
-
Filesize
448KB
MD5946d9474533f58d2613078fd14ca7473
SHA1c2620ac9522fa3702a6a03299b930d6044aa5e49
SHA256cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb
SHA5123653d41a0553ee63a43490f682c9b528651a6336f28adafc333d4d148577351122db8279ff83ee59bb0a9c17bb384e9f6c9c78677c8c5ed671a42036dec1f8c1
-
Filesize
1.2MB
MD503f6c8337def7e35584798b866515ca3
SHA1e4a604a5ca2a56ebf705bed131f4183fac068705
SHA256e67b2707d370871bbc96cae513df7a37473fa7284733261e224cb53914beb984
SHA512e80382cc462fd6f5a9a5a1376c40ba50ae46c723c99403ac8b55d4f93831f265e88555a1aea6c9a1217c5e31630df24e83afe85cc6539ab0626c57e121068c57
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.4MB
MD5097000ef27ee6d72b38ca8208c975c9d
SHA1e2bea6e54875b0b45f78dcc03cb0933310926792
SHA256e65f163e9d75e4a78aadff6906f00c9e438bab475dcf97219a9b798f995e5d48
SHA512d1ccfa54ee0cf55ead82010f30719c77e5ae71b3d6f47e080b3921cb3ccf78d1b0601341645a816372b8526054579183e86037fb9bba5a686f582875b0971fa3
-
Filesize
1KB
MD5d905589b102aa78d5604a20753719ab8
SHA15f1fda5cc7cc50e50a52a56ee0178bc211ac3d1c
SHA2569bf237ae87140dde39703c7979db1557cc93cb87a3d7fb1dc96400e9cd6f1bd9
SHA512e35b9acfb0e1706281780e0593140250b28b386d801139ad6fa034ab58057eabd442c314653f222a284bfad06051eae73aea8e4dde6bd0e6caeaec1415b9b443
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB